No entries match these filters. Clear filters
Zscaler GovCloud adds Real User Monitoring in ZDX, Client Connector 5.0 for Windows, AWS account tagging in Cloud Connector, and VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. provisioning roles︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Zscaler Digital Experience now adds Real User Monitoring to capture and analyze browser-level user interactions with applications for visibility into performance bottlenecks (FedRAMP Moderate FedRAMP Moderate A US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. ).︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Zscaler Client Connector 5.0 for Windows adds Wi-Fi Name (SSID) as a trusted network criterion, TLS 1.3 support with automatic fallback to TLS 1.2, and machine tunnels in Business Continuity mode to keep devices connected to Private Access apps when the Zscaler cloud is unreachable (requires Windows 11 24H2 build 26100 or later; Limited Availability). Zscaler Client Connector 5.0 for Windows now adds Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. on ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. -based Windows machines (requires ZDP Module 26.08 or later). Zero Trust Branch 8.2.1-P1 adds an Appliance Admin Console page giving administrators terminal access to appliances for troubleshooting (FedRAMP FedRAMP A US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate and High; Limited Availability). Cloud Connector now adds support for AWS account tagging across cross-account deployments with workload communications for multi-account environment organization (FedRAMP Moderate; Limited Availability).
+1 more
show less
Cloud Connector now adds a VDI Provisioning permission when adding admin roles, with Full, View Only, or None options for role-based access control role-based access control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. over virtual desktop infrastructure (FedRAMP Moderate and High).
Zscaler Digital Experience now adds Real User Monitoring to capture and analyze browser-level user interactions with applications for visibility into performance bottlenecks (FedRAMP Moderate FedRAMP Moderate A US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. ).︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Zscaler Client Connector 5.0 for Windows adds Wi-Fi Name (SSID) as a trusted network criterion, TLS 1.3 support with automatic fallback to TLS 1.2, and machine tunnels in Business Continuity mode to keep devices connected to Private Access apps when the Zscaler cloud is unreachable (requires Windows 11 24H2 build 26100 or later; Limited Availability). Zero Trust Branch 8.2.1-P1 adds an Appliance Admin Console page giving administrators terminal access to appliances for troubleshooting (FedRAMP FedRAMP A US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate and High; Limited Availability). Cloud Connector now adds support for AWS account tagging across cross-account deployments with workload communications for multi-account environment organization (FedRAMP Moderate; Limited Availability). Cloud Connector now adds a VDI Provisioning permission when adding admin roles, with Full, View Only, or None options for role-based access control role-based access control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. over virtual desktop infrastructure (FedRAMP Moderate and High).
1 more in Everything
└──▷ BREAKING ON UPGRADE
! Zscaler Client Connector 5.0 for Windows does not support Windows 32-bit.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-10-05
Oct 5, 2026
· release notes
ZPA adds UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. -aware App Connector selection and Global Rules/Policy Groups for application access.
UDP application segments can now select an App Connector closest to the application Global rules allow defining common logic once across multiple application access policies Policy groups enable organizing related policies with shared criteria applied automatically
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-10-02
Oct 2, 2026
· release notes
Adds support for up to five browser extensions in Zero Trust Browser isolation profiles via the Zscaler Admin Console.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-10-01
Oct 1, 2026
· release notes
ZPA adds SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. /SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. attribute support for legacy app VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. access policies
Client Connector — Client Connector App Release Summary (2026) — 2026-10-01
Oct 1, 2026
· release notes
macOS 5.0 adds Z-Tunnel wake restart, DNS bypass logic overrides, and CLI remote control; Linux 4.2.2 adds ARM64 ARM64 The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. , Alma/Rocky 9/10, and TPM TPM A dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. key support
Zscaler Client Connector on macOS now supports always bypassing DNS requests using the Zscaler Client Connector UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. proxy regardless of the setting in a user's app profile.Zscaler Client Connector on macOS adds granularity to restrict Private Access partner logins to specify which partner tenants can access your organization's tenant.Zscaler Client Connector on macOS supports enabling and disabling Internet & SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. and Digital Experience remotely via CLI.Zscaler Client Connector on macOS adds the Server Validated Client Certificate posture type that validates the client certificate against the cloud.Zscaler Client Connector on Linux 4.2.2 adds support for a TPM private key with a hard-coded PIN for Internet & SaaS registration.
+5 more
show less
Zscaler Client Connector on Linux 4.2.2 supports AlmaLinux 9 and 10.Zscaler Client Connector on Linux 4.2.2 supports Rocky Linux 9 and 10.Zscaler Client Connector on Linux 4.2.2 adds support for Zscaler Admin Console as an IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Authentication Service.Zscaler Client Connector on Linux 4.2.2 supports quarantining devices for Authentication Service.Zscaler Client Connector on Linux 4.2.2 supports step-up authentication for conditional access to Private Access and Internet & SaaS based on dynamic requests.
10 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-30
Sep 30, 2026
· release notes
New AI App Diagnostics validation, Azure Guardrails policy generation, and ZIP upload for MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. analysis.
Adds AI App Diagnostic feature to validate application configuration and integration before a full probe run to prevent failed runs. Adds Azure Guardrails support to the Policy Generator, providing generated API requests with Azure Resource Manager commands and JSON policies using Azure's RAI schema. Adds ZIP archive upload support for MCP Server MCP Server A process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Analysis to enable testing of private MCP servers not in public repositories.
3 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-09-30
Sep 30, 2026
· release notes
Incident Details Drawer UI updates move status and user fields to the top of Overview and Violation Details tabs.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-30
Sep 30, 2026
· release notes
ZPA Private Access introduces IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Attribute-Based VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. policies using SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. /SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attributes
Client Connector — Client Connector App Release Summary (2026) — 2026-09-30
Sep 30, 2026
· release notes
Zscaler Client Connector adds Process DNS Without Proxy Redirection config option for macOS; Windows gets VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. retry logic and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. override fixes
Updates Zscaler Client Connector 4.10.0.477 for Windows to retry gateway connections with exponential backoff capped at 60 seconds after five successive failures. Fixes Zscaler Client Connector on macOS and Windows ignoring custom PAC URLs when Strict Enforcement mode was enabled in Transparent-based Proxy Interception.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-30
Sep 30, 2026
· release notes
ZIA adds Personal Email Detection to Outbound Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and new filters/columns in Insights Logs
Adds support for detecting personal email addresses in outbound email DLP policy rules. Adds Personal Email filter and column to the Email DLP Insights Logs page.
2 details in Everything
Client Connector — ZDX Module Release Summary (2026) — 2026-09-29
Sep 29, 2026
· release notes
ZDX Module 4.7.0.128 adds SIPA Cloud Path, external proxy direct-connect, FIPS 140-3 FIPS 140-3 A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. , and remediation jobs
Adds Source IP Anchoring (SIPA) Cloud Path support for Digital Experience (ZDX). Adds TCPTCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. capabilities in Cloud Path probe configuration. Adds the option for a ZDX client to direct-connect to an external proxy. Enhances Real User Monitoring (RUM RUM Real User Monitoring — a technique that collects performance and behaviour data from actual users' browsers or clients in production, giving cyber tools visibility into real-world latency and errors rather than synthetic test results. ) capabilities. Supports admins to configure and run remediation jobs on a set of selected endpoint devices.
5 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-09-29
Sep 29, 2026
· release notes
Client Connector 5.0 adds TLS 1.3, SSID trust conditions, ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , machine tunnel Business Continuity, and silent install parameter.
Adds support for the TLS 1.3 protocol with automatic negotiation and fallback to TLS 1.2 if the server does not support 1.3 Supports Wi-Fi Name (SSID) as a condition for trusted network criteria, enabling trust decisions based on connected SSID Enables Endpoint Data Loss Prevention (DLP) on ARM processor-based Windows machines when using the ZDP Module version 26.08 and later Supports machine tunnels in Business Continuity mode to allow devices to stay connected to Private Access apps when the Zscaler cloud is unreachable Adds an installation parameter to launch Zscaler Client Connector without waiting for the Windows desktop to display, allowing silent autostart during boot sequences like Autopilot
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Windows 32-bit is no longer supported in version 5.0; users must upgrade to Windows 64-bit
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-29
Sep 29, 2026
· release notes
ZIA adds personal email detection to outbound DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and selective Slack workspace monitoring with chat bot filtering.
Adds Personal Email column and filter to the Email DLP Insights Logs page in ZIA Adds support for configuring Outbound Email DLP policies to detect personal email addresses Adds Selective Monitoring for Slack Workspaces via custom connector on zscalertwo.net Adds Chat Bots option in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan Configuration to include or exclude chat bots
4 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-25
Sep 25, 2026
· release notes
Secure AI Apps & Infrastructure gains time-range filtering and enhanced export in AI Guard Audit Log UI.
Adds custom and preset time range filters to the AI Guard Audit Log page Enhances the Initiator column in the Audit Log to display both username and email address Updates the Export CSV button to download only filtered audit log entries Adds a manual refresh button for the Audit Log list without full page reload
4 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-09-25
Sep 25, 2026
· release notes
Audit Log UI enhancements include initiator details, username search dropdowns, time range filters, and filtered CSV export.
Adds username and email display in the Audit Log Initiator column instead of email only Adds a dropdown for selecting usernames in the Initiator search functionality Adds custom and preset time range filters (e.g., Last 24 Hours) to the Audit Log page Adds a manual refresh button that reloads the list without reloading the entire page Updates the Export CSV button to download only the filtered audit log results
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-25
Sep 25, 2026
· release notes
ZIA adds NFKC normalization for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /EDM, Brave browser control support, and Zoom AI transcript scanning.
Adds NFKC normalization support to DLP phrase matching and EDM indexing to convert full-width unicode characters to half-width equivalents Extends Browser Control Policy to create policies, configure browser control, and HTTP header control for the Brave browser (User Agent criterion in Cloud App, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS Inspection, URL Filtering, Browser Blocking)
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-23
Sep 23, 2026
· release notes
ZIA adds 60 new Google Workspace SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls and personal email detection for outbound DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.
└──▷ USE IT
Add OAuth scopes for new Google Workspace SSPM controls via the ZIA UI or API.
steps
copy
Authorizing a Custom Zscaler Connector for Google Applications
Adds support for 53 new cloud identity and 7 mobile device SSPM controls for Google Workspace on zscaler.net, zscalertwo.net, zscalerthree.net, and zscloud.net. Adds Personal Email detection option in Outbound Email DLP Policy rules to match recipient names against the sender's organizational name. Adds Personal Email filter and column to the Email DLP Insights Logs page.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-22
Sep 22, 2026
· release notes
ZIA adds Personal Email detection to Outbound Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and Selective Slack Workspace monitoring via new connector options.
Adds Personal Email as a selectable condition in Outbound Email DLP policy rules to match sender org name against external recipient domains (e.g., Gmail, Yahoo) Adds Personal Email filter and column to the Email DLP Insights Logs page for displaying personal email addresses in logs Enables selective monitoring of specific Slack workspaces via custom connector during tenant onboarding Adds Chat Bots toggle option in Scan Configuration to include or exclude chatbots from SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security scans
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-21
Sep 21, 2026
· release notes
ZPA adds Unified RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for Private Access via a new central Role Management page.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-21
Sep 21, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds bulk MIP labeling in Resource Inventory, Azure application discovery via service principals, and GCP single-project onboarding.
Adds the ability to manually apply Microsoft Purview Information Protection (MIP) labels to multiple files in the Resource Inventory for on-premises file shares Introduces Azure Application Discovery that investigates service principal metadata to categorize and display Azure applications in the Resource Inventory graph Adds a Findings tab to the Compliance dashboard listing open issues for specific resources and compliance frameworks Enables Saved View filters and column visibility settings across all Compliance dashboard tabs Makes the Data Stores column on the Policies tab clickable to redirect to the Findings tab with the policy ID pre-selected
+1 more
show less
Adds GCP single project onboarding support for organizations with restrictions preventing organization-level onboarding
6 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-09-21
Sep 21, 2026
· release notes
Unified RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. support in ZDX allows central role management via new Administration page.
Adds Unified Role-Based Access Control Role-Based Access Control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) support for the Digital Experience (ZDX) Role
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! The existing ZDX Role Management page is deprecated if you use Unified RBAC
Authentication Service — Release Upgrade Summary (2026) — 2026-09-21
Sep 21, 2026
· release notes
Auth Service adds Unified RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. with central Role Management page and admin entitlement controls
Adds Unified Role-Based Access Control Role-Based Access Control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for Authentication Service, enabling central management of roles via the Role Management page Deprecates existing options to configure roles, permissions, and administrative entitlements in Authentication Service if Unified RBAC is used
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-21
Sep 21, 2026
· release notes
Selective Slack workspace monitoring and Chat Bot toggle added; Unified RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. now available.
Adds support for Selective Monitoring for Slack Workspaces via custom connector Adds Chat Bots option on the Scan Configuration page to include or exclude chatbots from DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /Malware scans Enables Unified Role-Based Access Control Role-Based Access Control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) with roles managed centrally on the Administration > Role Management > Role Management page
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The existing Internet & SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Role Management page is deprecated if you use Unified RBAC
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-09-21
Sep 21, 2026
· release notes
Limited availability of unified RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for centralizing role management.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-18
Sep 18, 2026
· release notes
ZPA Microsegmentation adds agent upgrade controls, resource group filtering, flow log aggregations, perimeter policies, and policy recommendations.
Adds the ability to halt an in-progress VM agent group upgrade from the Upgrade Status column on the Agent Groups page in the Zscaler Admin Console. Adds an upgrade window configuration option for agent groups to control the duration of an upgrade sequence. Adds selection of upgrade sequence (Serial or Parallel) and upgrade strategy (Halt next agent upgrade or Skip to next agent) when initiating on-demand upgrades. Adds filtering user-defined resource groups by type (managed or unmanaged) on the Resource Groups page in the Zscaler Admin Console. Adds a new Flow Log Aggregations page for Microsegmentation, allowing view of aggregated network flows up to 14 days and filtering by AppZone, source, and destination resource groups.
+2 more
show less
Adds a new Perimeter Policies page and support for creating perimeter policies (Block, Sim Block, Allow) for managed resource groups directly from the Resource Groups page or the new Perimeter Policies page. Adds policy recommendations based on historical network flows in the Application Map drawer, allowing review, editing, acceptance, merging, or rejection of proposed security policies for a resource group.
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-18
Sep 18, 2026
· release notes
ZIA adds Brave browser support to policies, NFKC normalization for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /EDM, User Group log filters, and Zoom AI transcript scanning
Adds User Group filter to Insights Logs pages (Web, Firewall, DNS, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security, Endpoint DLP, Email DLP), Dashboard widgets, and Interactive Reports Extends Brave browser support to Cloud App Control, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS Inspection, URL Filtering policies, Browser Blocking, and HTTP Header Control Adds NFKC normalization for Data Loss Prevention (DLP) phrase matching and Exact Data Match (EDM) indexing Enables scanning of AI transcript and AI meeting summary content types for Zoom tenants with DLP at rest
4 details in Everything
Deception — Release Upgrade Summary (2026) — 2026-09-18
Sep 18, 2026
· release notes
Zscaler Deception adds large POST payload preservation, new datasets, SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. /FTP banner support, and Zero Trust hostname flexibility.
Preserves unusually large POST request payloads as http_request evidence for web events across static, dynamic, and high-interaction containers (TI and internal decoys). Adds a new high-interaction dataset: Fortinet FortiGate GUI GUI A graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. for FortiOS v7.6.7. Introduces support for OS-specific Server Message Block (SMB) banners in Miragemaker. Updates FTP banners to support OS-based classification and adds new FTP banners. Adds security requirements for the /tmp/landmine.txt configuration file during Landmine Agent installation on macOS and Linux endpoints (must be root-owned, not a symlink, not writable by non-root users).
+2 more
show less
Supports deploying Zero Trust Network decoys with different FQDNs that share the same hostname (e.g., decoy.corp-internal.com and decoy.corp.com sharing the hostname decoy). Replaces default AMQP credentials (guest/guest) with realistic credentials (admin/admin) for Network decoys.
7 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-17
Sep 17, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds bulk MIP labeling, Azure app discovery, enhanced Compliance dashboard tabs, and single-project GCP onboarding.
Adds UI capability to manually apply Microsoft Purview Information Protection (MIP) labels to multiple files in the Resource Inventory page Introduces Azure Application Discovery feature that classifies service principals into six categories displayed in the Resource Inventory graph Adds a Findings tab to the Compliance dashboard listing open issues for resources and compliance frameworks Adds Saved View option for all Compliance dashboard tabs allowing custom filter and column persistence Makes the Data Stores column on the Policies tab clickable to redirect to the Findings tab with the policy ID pre-selected
+1 more
show less
Enables GCP single project onboarding for environments with organization-level restrictions
6 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-16
Sep 16, 2026
· release notes
Secure AI Apps & Infrastructure adds Compliance Mapping, MCP Server MCP Server A process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. Analysis/ratings, and System Info Leakage probe for AIRT
Adds the Compliance Mapping page to AIRT for a tenant-wide view of posture across frameworks Adds MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Server Analysis visibility into security posture of open-source and proprietary MCP servers Adds MCP Security Ratings catalog of public MCP servers with Zscaler testing results Adds System Information Leakage probe to AIRT that simulates attacks to reveal architecture details
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-15
Sep 15, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds MIP label application to Resource Inventory, Azure app discovery, GCP single project onboarding, and Compliance dashboard enhancements
Adds the ability to manually apply Microsoft Purview Information Protection (MIP) labels to multiple files in on-premises file shares directly from the Resource Inventory page Adds Azure Application Discovery that investigates service principal metadata to categorize Azure applications as internal, third-party, Microsoft, or various managed identity/agent types in the Resource Inventory graph Adds a new Findings tab to the Compliance dashboard listing open issues for specific resources and compliance frameworks Enables saved views with filters and column visibility for all tabs in the Compliance dashboard Makes the Data Stores column on the Policies tab clickable to redirect to the Findings tab with the policy ID pre-selected
+1 more
show less
Adds support for onboarding GCP single projects individually when organization-level onboarding is restricted
6 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-09-15
Sep 15, 2026
· release notes
Client Connector 4.10.0.463 adds Imprivata switch improvements, ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support, and desktop-skip install param
Improves user-switching process for Imprivata integration to eliminate downtime during switches
1 detail in Everything
Zscaler launches Zero Trust Exchange Agentic Operations with a hosted MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server and ZAgent for AI-driven administrative workflows︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ HOW TO FIND IT
Investigate why a user cannot reach a business-critical application using ZAgent in the Experience Center, without manually navigating multiple consoles or logs.
📍 In the Experience Center, open ZAgent and type: 'Why can't [user] reach the finance application?' — ZAgent routes the request to the appropriate Zscaler agents and skills, gathers context, and returns a likely cause and recommended remediation.
Introduces Zero Trust Exchange Agentic Operations, a new hosted operational layer exposing intent-based tools and skills to first-party and third-party AI agents via a hosted Model Context Protocol Model Context Protocol Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Introduces ZAgent , Zscaler's native agentic experience within the Experience Center, allowing administrators to describe objectives in natural language and receive coordinated responses from specialized Zscaler agents and skills. Supports connecting approved commercial AI clients (Claude, ChatGPT) and custom customer-built agents through an OAuth 2.1 OAuth 2.1 A consolidated draft of the OAuth authorization framework that merges OAuth 2.0 with its most important security BCP updates, dropping unsafe flows so tools can delegate user access without handling credentials directly. authorization flow, with per-user role-scoped consent and revocation. Provides an Agentic Operations Gateway handling routing, identity, authorization, approval controls, and auditing for all agent interactions, with client registration and token lifecycle events recorded in Zscaler audit logs. Enables Super Administrators to review and revoke authorization grants across the entire organization from a central view.
5 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-09-14
Sep 14, 2026
· release notes
Zscaler Workflow Automation adds granular DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. privacy settings and Incident Details drawer enhancements.
Adds Hide Policy Details for Non-Triggered Matches privacy settings to Zscaler DLP Azure and GCP integrations for Admin, End User, and Manager/Approver roles Adds Next/Previous incident navigation icons in the Incident Details drawer Allows setting a default tab in the Incident Details drawer via the star icon, persisted in browser local storage
3 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-11
Sep 11, 2026
· release notes
AI Guard adds optional user, clientName, and appName fields to DAS DAS Direct-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. resolve-and-execute API.
The new user, clientName, and appName fields are visible in the Transaction Details window of the dashboard.
1 detail in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-09-11
Sep 11, 2026
· release notes
Zscaler Client Connector Portal v4.5.6 introduces platform controls for Windows installer bits and clarifies group sources in the UI.
Adds a platform setting that enables control of the Use 64-Bit Installer for Windows option when configuring an app update in the Zscaler Client Connector App Store
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-11
Sep 11, 2026
· release notes
ZIA adds SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Scan checkbox to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Application Tenant onboarding for combined security checks and add-ons.
Removes App Governance functionality selection from the SaaS Application Tenant page.
1 detail in Everything
Zscaler GovCloud gains unified Experience Center console, OneAPI gateway, and consolidated Authentication Service with FIDO2 FIDO2 The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. support︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
Introduces OneAPI, a unified API gateway providing programmatic access to management, configuration, analytics, and event-monitoring capabilities across Zscaler products, enabling integration with CI/CD, SOAR SOAR Security orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. , and SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. workflows for GovCloud tenants.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Introduces Authentication Service, a single OpenID OpenID An open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. /SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. -based authentication layer for all Zscaler products on GovCloud, replacing per-product IDP IDP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. federations with a consolidated Federal ICAM integration point. Adds native FIDO2 key enrollment within Authentication Service, allowing admins to enroll FIDO2 keys directly in Zscaler independent of IDP provisioning timelines. Introduces Experience Center, a unified administration console that consolidates management, configuration, monitoring, reporting, and dashboards across all Zscaler products into a single interface for GovCloud tenants. Provides a single RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. model across all Zscaler products within Experience Center, replacing separate per-product permission systems.
+2 more
show less
Delivers a wizard-guided migration to Authentication Service with automatic policy carryover and a revert option during the transition window. Makes Experience Center, OneAPI, and Authentication Service available now for GovCloud Moderate and High tenants with no additional deployment required.
7 details in Everything
Zscaler Zero Trust Browser Extension now enforces existing policies inside the ChatGPT desktop app's embedded Chromium browser on macOS and Windows.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
└──▷ HOW TO FIND IT
Start with full visibility before writing block rules — log every page the ChatGPT agent opens without blocking anything.
📍 In the Zscaler Zero Trust Browser admin console, create a policy named Monitor All Website Visits with a single catch-all rule: Condition: page.url exists | Effect: Allow | Severity: Informational. Assign it to the target user group covering ChatGPT desktop app users.
Prevent users from pasting sensitive data into a known DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. test site when ChatGPT opens it in the embedded browser.
📍 In the Zscaler Zero Trust Browser admin console, create a policy named Block Paste on DLP Test Site with rule: Condition: page.url.domain is equal to dlptest.com | Effect: Block | Severity: Medium. Assign to the relevant user group.
Block entire URL categories (e.g., Gambling) for ChatGPT agent browsing so that category-aware blocks catch retry attempts across domains.
📍 In the Zscaler Zero Trust Browser admin console, create a policy named Block Gambling websites with rule: Condition: page.url.category is one of Gambling | Effect: Block | Severity: Medium. Assign to the relevant user group.
Extends the Zero Trust Browser Extension to run inside the ChatGPT desktop app's embedded Chromium browser, enforcing the same policies (DLP, paste controls, URL category blocking, file upload/download, credential protection, tenant restrictions) that already apply in Chrome, Edge, Firefox, and Safari — with no separate rulebook for the embedded case.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄ Deploys into the ChatGPT embedded browser via the same MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. -based method used for other browsers, requiring an explicit change to the deployment script to target the ChatGPT desktop app's embedded browser (installing for Chrome does not cover it automatically). Surfaces agent-driven page loads in the Zscaler admin console as standard detections carrying user identity, device posture, extension version, browser, IP, geolocation, and URL — making ChatGPT-opened pages visible alongside all other Chromium tab activity. Supports monitoring, paste-block (with clipboard content capture), and URL-category block policies (e.g., Gambling) enforced directly inside the ChatGPT embedded browser, with the Zscaler Paste Blocked and Content Blocked interstitials rendered in-page.
4 details in Everything
Agentic SOC — Release Upgrade Summary (2026) — 2026-09-09
Sep 9, 2026
· release notes
Agentic SOC SOC A security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. introduces Automation Rules and Playbooks for SOAR SOAR Security orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. capabilities
Adds Automation Rules that automatically trigger playbooks based on event severity, entity type, incident, or threat category Adds Playbooks to configure sequences of automated remediation actions like enabling MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. , clearing sessions, or suspending users
2 details in Everything
Zscaler adds AI Attack Chain Analysis for endpoints and an AI Access Graph for identity risk, plus a CrowdStrike SSF/SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration.
New Endpoint AI Security Attack Chain Analysis capability (powered by OpenAI GPT cyber models) evaluates an endpoint's full state — including local AI agents, browser extensions, packages, and system configurations — and constructs a realistic attack chain from initial lure to code execution, producing a prioritized remediation roadmap instead of a flat CVE list. New AI Access Graph maps human, service-account, and AI-agent identities to data objects and cloud endpoints, traces access paths, flags overprivileged or toxic permission combinations, and ranks risks by business impact, blast radius, and resource confidentiality across multi-cloud environments. New integration with CrowdStrike using the OpenID OpenID An open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Shared Signals Framework (SSF) lets the CrowdStrike Falcon platform continuously share user-risk signals with Zscaler's Adaptive Access Engine (AAE) so that access policies adjust dynamically in real time when suspicious endpoint behavior is detected. Zscaler telemetry and AI-event metadata now stream directly into CrowdStrike Falcon Next-Gen SIEM, enabling unified cross-domain visibility and end-to-end investigation across user behavior and network traffic in a single console. Analysts can trigger Zscaler enforcement actions and automated remediation directly from within the Charlotte Agentic SOAR SOAR Security orchestration, automation and response, coordinating incident workflows across tools. Playbooks can gather evidence, assign work or carry out approved response actions. interface, running natively inside the Falcon platform with no middleware or separate infrastructure.
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-04
Sep 4, 2026
· release notes
AppProtection policies can now be applied to federated B2B applications for guest users
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-09-04
Sep 4, 2026
· release notes
ZDX adds data center filtering to dashboards and device count enhancements.
Adds ability to filter by Zscaler Data Center on select dashboards Enhances device count to include devices shared among multiple users
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-04
Sep 4, 2026
· release notes
ZIA adds Claude tenant profile support and CLAUDE_AI enum to Tenancy Restriction Profile APIs.
appType query parameter now accepts CLAUDE_AI in the GET /tenancyRestrictionProfile/app-item-count/{appType}/{itemType} API endpointTenant Profiles feature extended to Claude, allowing access control by specific workspace IDs TenancyRestrictionProfile model now includes CLAUDE_AI in its appType field
3 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-03
Sep 3, 2026
· release notes
New AI Prefill Prefill The first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. modal for AIRT context automation, expanded Connection Type categories, and public Agent Skills Registry for AIRT.
Adds AI Prefill automated workflow in the AI Red Teaming interface to suggest application description, language, multi-step attacks, and supported modes after initial connectivity is established Expands Connection Type categorization to include third-party model wrappers (Poe, OpenRouter OpenRouter A unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. , Monica, You.com, Venice, Ask AI, CrewAI) and merges You.com Research and You.com Answer into a single You.com card with mode toggle in the UI Introduces Public Agent Skills Registry for AI Red Teaming, allowing assessment of safety ratings for public agent skills prior to production deployment
3 details in Everything
AI Asset Management — Release Upgrade Summary (2026) — 2026-09-03
Sep 3, 2026
· release notes
AI Asset Management adds GCP single project onboarding and nine new Azure/Azure OpenAI security policies.
Adds support for onboarding Google Cloud Platform (GCP) single projects to AI Security for monitoring and scanning data stores Adds nine new Azure and Azure OpenAI AI Security policies including checks for unencrypted API endpoints, Bing search, empty instructions, missing descriptions, API key usage in security schemes, code interpreter, and file search status
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-09-03
Sep 3, 2026
· release notes
ZIA adds Secure Email Gateway support to Outbound Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and new proximity match types for custom dictionaries
Adds Secure Email Gateway (SEG) as a supported tenant type in Outbound Email DPA policies under Policies > Data Protection > Policy > Email Tenants. Enforces strict SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS and valid, trusted server certificates for SMTP SMTP The application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. connections, rejecting self-signed or expired certs. Introduces near and not near proximity match types for Custom DLP Dictionaries to define byte-level phrase distance.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! SMTP connections now require strictly valid SSL/TLS certificates; self-signed, expired, or invalid certificates are no longer accepted.
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-09-03
Sep 3, 2026
· release notes
New Cleanup Activity page in Cloud & Branch Connector to manage inactive group deletion history.
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-09-02
Sep 2, 2026
· release notes
AI Guard adds proxy mode conversation view and Anthropic webhook test
Adds Conversation View for Proxy Mode Transactions to the AI Guard dashboard, allowing admins to see full multi-turn conversation threads instead of isolated transactions. Adds Anthropic Connection Test for Webhook capability from the Anthropic console to verify connectivity with AI Guard.
2 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-09-02
Sep 2, 2026
· release notes
Multi-turn conversation view in AI Guard Proxy mode and Anthropic webhook test
Enables viewing full multi-turn conversation threads for Proxy mode transactions directly in the AI Guard dashboard
1 detail in Everything
Agentic SOC — Release Upgrade Summary (2026) — 2026-09-02
Sep 2, 2026
· release notes
Agentic SOC SOC A security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. adds historical measure condition viewing for dashboard widget items
Adds the ability to view historical measure conditions and item states within a specified time period in a dashboard widget
1 detail in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-09-02
Sep 2, 2026
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. introduces ZAgent Skills for Data Protection, enhancing its AI virtual assistant to troubleshoot complex tasks and analyze data protection in multi-cloud platforms.
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-09-02
Sep 2, 2026
· release notes
AEM adds ability to view historical measure conditions for items in dashboard widgets.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-09-01
Sep 1, 2026
· release notes
ZPA adds Log Streaming Service support for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Legacy Apps logs and SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. /SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. -driven Microtenant creation via API.
Enables Log Streaming Service support for VPN (for Legacy Apps) data types: User Status - VPN Service Edge (IP Address Reservation), User Status - VPN Service Edge, and Traffic Flow - VPN Adds SAML and SCIM support for creating Microtenants based on attributes or group criteria, including logical operators (AND, OR) Exposes Microtenant creation functionality via the cloud service API
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-31
Aug 31, 2026
· release notes
Adds Chrome Enterprise Browser support for Privileged Remote Access (PRA) in Zscaler Private Access.
Enables Chrome Enterprise browser as a supported client for Privileged Remote Access (PRA). Releases Manager software version 26.56.8 for Network Connectors, including an updated RPM package for Red Hat Enterprise Linux 9.x.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-31
Aug 31, 2026
· release notes
ZIA adds granular upload control for Google Gemini and expiration actions for Google Drive links via DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules.
Uploading granular action added to the Add/Edit AI & ML Rule window in Cloud App Control policy for Google Gemini.fileSharingExpiryTimeType and fileSharingExpiryTime fields added to CASBDlpRule model for /casbDlpRules API to set expiration periods.Enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY added to the action field in CASBDlpRule model.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-28
Aug 28, 2026
· release notes
ZIA adds enhanced DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries, WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. inspection, API profile limit expansion, Jira labels for CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. , and new firewall app support
Adds cloning capability for predefined DLP sub-dictionaries in the ZIA admin console, allowing customization of Confidence Score Threshold, Proximity Length, and Custom High Confidence Phrases without modifying originals. Adds Credit Card Image predefined dictionary to DLP engines for detecting credit card images in JPEG and PNG files. Expands WebSocket inspection to cover bidirectional traffic, enabling security controls on supported content types. Adds support for Jira Application Labels as an action in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP Policies (Policies > Data Protection > Policy > Out-of-Band CASB). Extends Network Applications visibility and filtering to WARP, DOQ, DOH3, STOMP, and AMQP.
+1 more
show less
Increases the profileId field limit for Indexed Document Match (IDM) profiles via the /idmprofile APIs from 64 to 512.
6 details in Everything
Zscaler Zero Trust Browser gains WebMCP Security Controls to discover, monitor, and block AI agent tool calls in-page.
└──▷ HOW TO FIND IT
Start in monitor mode to baseline all AI agent tool calls across sites before writing any block rules — every webmcp.* attribute is logged as an Informational/Allow detection without disrupting users.
📍 In the Zscaler admin console, create a policy named Monitor WebMCP with all seven webmcp.* attributes enabled, default effect set to Allow, and assign it to the target user group. Open the Detections view to stream every WebMCP tool registration and invocation with full user, device, and argument context.
Block a specific AI agent capability by tool name — for example, prevent any agent from invoking update_cart on any covered site, with the block surfaced inline to the user.
📍 In the Zscaler admin console, create a policy named Block WebMCP with condition: webmcp.tool.name is equal to update_cart, effect: Block. The Detections view will show a Low-severity Block entry with Reason: webmcp.tool.name is equal to UPDATE_CART on every blocked invocation.
Apply argument-level (DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. -style) inspection to block agent tool calls whose JSON payload matches a keyword, while allowing the same tool with clean payloads.
📍 In the Zscaler admin console, create a policy rule with condition: webmcp.tool.arguments contains book , effect: Block. Calls to update_cart with payloads such as {"cart":{"line_items":[{"handle":"book-cat-graphic-tee-apple-blossom-26f12103","quantity":1}]}} are blocked and the full argument payload is captured verbatim in the detection record.
Adds WebMCP Capability Discovery: the Zero Trust Browser Extension enumerates every tool a WebMCP-enabled site registers before any can run, capturing seven attributes per tool — webmcp.tool.name, webmcp.tool.description, webmcp.tool.arguments, webmcp.tool_count, webmcp.tool.provider_origin, webmcp.tool.is_cross_origin, and webmcp.tool.has_untrusted_content_hint — building a structured inventory of the agentic surface per site and user. Adds WebMCP Runtime Monitoring: every tool invocation is captured with full context (the seven webmcp.* attributes plus user identity, device posture, extension version, browser, IP, geolocation, and URL) and surfaced in the Zscaler admin console as a searchable, filterable, exportable detection in the same event stream as existing platform telemetry. Adds WebMCP Policy Enforcement: inline policies match on any of the seven webmcp.* attributes and apply one of three effects — Allow , Monitor , or Block — intercepting tool calls before the site's handler runs, with blocked calls surfaced to the user directly inside the agent's reply. Policy rules support matching on tool identity (webmcp.tool.name), argument content (webmcp.tool.arguments), provider origin (webmcp.tool.provider_origin), and cross-origin and untrusted-content signals (webmcp.tool.is_cross_origin, webmcp.tool.has_untrusted_content_hint), enabling DLP-style argument-level inspection of AI agent payloads. Blocked tool calls return a structured failure to the agent ('The Zscaler Zero Trust Browser blocked this action for security reasons') with the exact rule reason (e.g., webmcp.tool.name is equal to UPDATE_CART) logged as a Low-severity Block detection in the admin console.
5 details in Everything
Zscaler Zero Trust Browser gains WebMCP Security Controls to discover, monitor, and block AI agent tool calls in-page.
└──▷ HOW TO FIND IT
Start in monitor mode to baseline all AI agent tool calls across sites before writing any block rules — every webmcp.* attribute is logged as an Informational/Allow detection without disrupting users.
📍 In the Zscaler admin console, create a policy named Monitor WebMCP with all seven webmcp.* attributes enabled, default effect set to Allow, and assign it to the target user group. Open the Detections view to stream every WebMCP tool registration and invocation with full user, device, and argument context.
Block a specific AI agent capability by tool name — for example, prevent any agent from invoking update_cart on any covered site, with the block surfaced inline to the user.
📍 In the Zscaler admin console, create a policy named Block WebMCP with condition: webmcp.tool.name is equal to update_cart, effect: Block. The Detections view will show a Low-severity Block entry with Reason: webmcp.tool.name is equal to UPDATE_CART on every blocked invocation.
Apply argument-level (DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. -style) inspection to block agent tool calls whose JSON payload matches a keyword, while allowing the same tool with clean payloads.
📍 In the Zscaler admin console, create a policy rule with condition: webmcp.tool.arguments contains book , effect: Block. Calls to update_cart with payloads such as {"cart":{"line_items":[{"handle":"book-cat-graphic-tee-apple-blossom-26f12103","quantity":1}]}} are blocked and the full argument payload is captured verbatim in the detection record.
Adds WebMCP Capability Discovery: the Zero Trust Browser Extension enumerates every tool a WebMCP-enabled site registers before any can run, capturing seven attributes per tool — webmcp.tool.name, webmcp.tool.description, webmcp.tool.arguments, webmcp.tool_count, webmcp.tool.provider_origin, webmcp.tool.is_cross_origin, and webmcp.tool.has_untrusted_content_hint — building a structured inventory of the agentic surface per site and user. Adds WebMCP Runtime Monitoring: every tool invocation is captured with full context (the seven webmcp.* attributes plus user identity, device posture, extension version, browser, IP, geolocation, and URL) and surfaced in the Zscaler admin console as a searchable, filterable, exportable detection in the same event stream as existing platform telemetry. Adds WebMCP Policy Enforcement: inline policies match on any of the seven webmcp.* attributes and apply one of three effects — Allow , Monitor , or Block — intercepting tool calls before the site's handler runs, with blocked calls surfaced to the user directly inside the agent's reply. Policy rules support matching on tool identity (webmcp.tool.name), argument content (webmcp.tool.arguments), provider origin (webmcp.tool.provider_origin), and cross-origin and untrusted-content signals (webmcp.tool.is_cross_origin, webmcp.tool.has_untrusted_content_hint), enabling DLP-style argument-level inspection of AI agent payloads. Blocked tool calls return a structured failure to the agent ('The Zscaler Zero Trust Browser blocked this action for security reasons') with the exact rule reason (e.g., webmcp.tool.name is equal to UPDATE_CART) logged as a Low-severity Block detection in the admin console.
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-27
Aug 27, 2026
· release notes
Emergency Access for Privileged Remote Access (PRA) added with Authentication Service integration
Adds Emergency Access support for Privileged Remote Access (PRA) in Private Access (ZPA) Requires Authentication Service as IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for PRA Emergency Access, replacing Okta
2 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-08-26
Aug 26, 2026
· release notes
AI Guard adds CrowdStrike SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Direct Export and base64 detector support, expands policy limits
Adds CrowdStrike SIEM Direct Export (HEC HEC An HTTP API endpoint provided by Splunk that lets applications stream JSON-formatted events directly into a Splunk index without a forwarder agent, reducing pipeline complexity for log-shipping tools. endpoint) as a log export destination for AI Guard Adds CrowdStrike portal parser zscaler-aiguard under Generic bender connection type for AI Guard data connectors Increases Topic definition character limit to 1000 characters in policy configuration Expands LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Provider match criteria entries from 10 to 100 in Policy control Adds detector version information display in the Policy Configuration UI
+1 more
show less
Enables base64 encoding support for all AI Guard detectors
6 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-08-26
Aug 26, 2026
· release notes
Secure Access to AI Apps adds CrowdStrike SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. Direct Export and parser
Adds CrowdStrike HEC endpoint as a direct log export destination for AI Guard logs, alongside the existing S3-dependent option. Adds support for the new zscaler-aiguard parser under the Generic bender connection type in CrowdStrike for AI Guard data connectors.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-26
Aug 26, 2026
· release notes
ZIA adds near/not-near DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. proximity matching, Microsoft TNEF email attachment support, Google Drive link expiration via new CASBDlpRule API fields and enums.
Custom DLP dictionaries now support near and not near proximity match types to define byte-level phrase distance for detection Outbound Email DLP policies now include Microsoft TNEF file type as a supported attachment option when creating policies without content inspection Google Drive DLP rules gain expiration-based remediation actions with new fileSharingExpiryTimeType and fileSharingExpiryTime fields in the /casbDlpRules API New enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY are added to the action field in the CASBDlpRule model SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets with Incidents page now supports setting manual expiration for Google Drive files under Remediation Actions
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Strict SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS enforcement and server certificate validation are now required for SMTP SMTP The application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. connections; self-signed, expired, or invalid certificates are no longer allowed for Email tenants.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-25
Aug 25, 2026
· release notes
New zpn_siem_type_bc_event_log log type added to ZPA Cloud Service API and LSS for Business Continuity events.
Adds zpn_siem_type_bc_event_log as a new log type in the /mgmtconfig/v2/admin/customers/{customerId}/lssConfig API response for Business Continuity Events Enables selection of the new Business Continuity log type when configuring a log receiver in Log Streaming Service (LSS) Adds multi-file upload capability (up to 10 files) to the PRA Portal My Files feature Adds storage usage and total capacity statistics display on the PRA Portal My Files page Adds bulk file selection and deletion support in the PRA Portal My Files feature
5 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-08-21
Aug 21, 2026
· release notes
Adds platform setting to control 64-bit Windows installer in app updates
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-21
Aug 21, 2026
· release notes
Adds multimatch traffic inspection capability to Private Access application segments in Limited Availability.
Adds application segment support for Internet & SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. (ZIA) and Multimatch inspection.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-21
Aug 21, 2026
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. sub-dictionary cloning, Credit Card Image dict, Go to File for Salesforce, and Google Drive link expiration APIs.
Adds CLAUDE_AI enum to the appType query parameter in the GET /tenancyRestrictionProfile/app-item-count/{appType}/{itemType} endpoint and TenancyRestrictionProfile model for Tenant Profile support of Claude. Adds four new expiration actions (Remove Collaborators After Expiry , Remove External Sharing Links After Expiry , Remove Internal Sharing Links After Expiry , Remove Sharing After Expiry ) and two fields (fileSharingExpiryTimeType, fileSharingExpiryTime) to the CASBDlpRule model for Google Drive link expiration. Adds enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY to the action field in the /casbDlpRules APIs. Adds support for cloning predefined DLP sub-dictionaries via the UI to create customized copies without modifying originals. Adds support for the Credit Card Image predefined dictionary to detect credit card images in JPEG and PNG files within DLP policies.
+1 more
show less
Adds Microsoft TNEF file type support for Outbound Email DLP policies created without content inspection.
6 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-08-20
Aug 20, 2026
· release notes
Enhanced Incident Details Drawer for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Email incidents shows policy-specific trigger data and redesigned tabs.
Incident Details drawer for DLP Email incidents now displays triggering dictionaries and engines in the Policy section.
1 detail in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-08-20
Aug 20, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure single-subscription onboarding, manual MIP labeling in Data Inventory, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Overview dashboard, Saved Views for alerts/duplications, and Snowflake graph publi
Azure Single Subscription Onboarding allows onboarding individual Azure subscriptions for data store monitoring when tenant-level restrictions existManual File Actions in Data Inventory now supports applying Microsoft Purview Information Protection (MIP) labels to single or multiple on-premises and Azure file shares SaaS Overview Dashboard moved into DSPM to visualize detected incidents, top affected users, and publicly exposed SaaS applications containing sensitive dataSaved Views feature added for Alerts and Data Duplications tables to save custom filters and column visibility settingsSnowflake Database Graph now includes a public internet node to show databases publicly exposed to the internet
5 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-08-19
Aug 19, 2026
· release notes
Secure AI Apps & Infrastructure adds EU-hosted AI Red Teaming, new target integrations, and model-specific prompt hardening.
Adds dedicated infrastructure to host the entire AI Red Teaming deployment within the EU region for data residency compliance. Adds ability to select a model developer (OpenAI, Anthropic, Google, Meta, Mistral, DeepSeek, xAI, Alibaba/Qwen) for Standalone prompt hardening to generate provider-specific protection instructions.
2 details in Everything
AI Asset Management — Release Upgrade Summary (2026) — 2026-08-19
Aug 19, 2026
· release notes
New AWS Bedrock, Azure AI Foundry, and Microsoft Copilot Studio Agent detection policies in Zscaler AI Asset Management
Adds AWS bedrock Agents to the list of supported policy categories Adds Azure AI Foundry Hub to the list of supported policy categories Adds Azure OpenAI to the list of supported policy categories Adds Microsoft Copilot Studio Agent to the list of supported policy categories Detects when Azure OpenAI Agents have empty instructions via new policy detection
+10 more
show less
Detects when Microsoft Copilot Studio Agent has manual authentication configured via new policy detection Detects when Microsoft Copilot Studio Agent is using publisher dev credentials via new policy detection Detects when AWS Bedrock Agent guardrails have prompt attack filter disabled via new policy detection Detects when AWS Bedrock Agent function-based action group invocation confirmation is disabled via new policy detection Detects when AWS Bedrock Agent has code interpretation enabled without guardrails via new policy detection Detects when AWS Bedrock Agent guardrails have PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. filtering disabled via new policy detection Detects when Azure AI Foundry Hub Agents have Bing Search enabled via new policy detection Detects when Azure AI Foundry Hub Agents have empty instructions via new policy detection Detects when Azure AI Foundry Hub Agents use external tools with temperature > 0.7 via new policy detection Detects when Azure AI Foundry Hub Agents use API keys in security schemes via new policy detection
15 details in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-08-19
Aug 19, 2026
· release notes
New password policy options to disable accounts on failed attempts and reject reused passwords in Zscaler Admin Console.
Adds the ability to configure the number of unsuccessful authentication attempts that trigger account deactivation. Adds the ability to configure the number of previously used passwords that are rejected during password changes. Allows customization of both new policy values within a configurable range from 3 to 10 in the Zscaler Admin Console.
3 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-08-18
Aug 18, 2026
· release notes
Client Connector adds Endpoint AI Security auto-install on macOS and India subcloud support on Android/ChromeOS.
Enables automatic installation of the endpoint software used with Endpoint AI Security through Zscaler Client Connector on macOS Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-08-17
Aug 17, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure single subscription onboarding, manual MIP labeling, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Overview dashboard, saved views in alerts/duplications, and Snowflake graph public node visibility
Adds the ability to onboard individual Azure subscriptions for DSPM monitoring and scanning without requiring tenant or management group level access. Enables applying Microsoft Purview Information Protection (MIP) labels manually to on-premises file shares and Azure file shares via the Data Inventory. Introduces the SaaS Overview dashboard within DSPM to visualize detected incidents, affected applications/users, and public exposure of sensitive data in SaaS apps. Adds Saved Views for the Alerts and Data Duplications tables, allowing users to save customized filters and column visibility settings. Enhances the Snowflake database graph with a new node indicating databases publicly exposed to the internet.
5 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-08-14
Aug 14, 2026
· release notes
New portal setting controls Use 64-Bit Installer for Windows app updates
Adds a platform setting to enable control of the Use 64-Bit Installer for Windows option in the Zscaler Client Connector App Store.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-14
Aug 14, 2026
· release notes
Zscaler Private Access extends Microsegmentation support to RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 10 and SLES 16.
Adds RHEL 10 support for Microsegmentation Adds SLES 16 support for Microsegmentation
2 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-08-14
Aug 14, 2026
· release notes
Zscaler Client Connector 4.10 for Windows introduces new automation for Endpoint AI Security software installation via the client application.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-14
Aug 14, 2026
· release notes
ZIA adds C2C DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. query param, Google Drive link expiration APIs, Claude tenant profiles, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. firewall filters, and WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. inspection.
Adds excludeDisabledC2CForwarding query parameter to GET /cloudToCloudIR, GET /cloudToCloudIR/lite, and GET /cloudToCloudIR/count APIs. Adds featuresSupported field to the C2CIncidentReceiver object returned by Cloud-to-Cloud DLP Incident Receiver APIs. Supports automatic expiration of Google Drive links (internal/external) via new remediation actions: Remove Collaborators After Expiry , Remove External Sharing Links After Expiry , Remove Internal Sharing Links After Expiry , and Remove Sharing After Expiry . Adds enum values OFLCASB_DLP_REMOVE_COLLABORATORS_EXPIRY, OFLCASB_DLP_REMOVE_SHARING_EXPIRY, OFLCASB_DLP_REMOVE_INTERNAL_LINK_SHARE_EXPIRY, and OFLCASB_DLP_REMOVE_EXTERNAL_LINK_SHARE_EXPIRY to the action field in the CASBDlpRule model. Adds fileSharingExpiryTimeType and fileSharingExpiryTime fields to the CASBDlpRule model for setting file sharing expiration periods.
+8 more
show less
Extends Tenant Profiles support to the Claude application, allowing access control via workspace IDs. Adds CLAUDE_AI enum to the appType query parameter in GET /tenancyRestrictionProfile/app-item-count/{appType}/{itemType} and to the TenancyRestrictionProfile model. Adds new search filters for Firewall Filtering Policy Rules: Rule Status , Network Application Groups , Application Service Groups , Source Country , Destination Country , Source IPv6 Groups , and Destination IPv6 Groups . Increases the profileId field limit in the IdmProfile object from 64 to 512 for the Indexed Document Match (IDM) profile index tool template. Adds support for identifying new network applications: WARP, DOQ, DOH3, STOMP, and AMQP. Enables the Go to File action in Salesforce to navigate directly to violated files from incidents. Adds Apply Jira Classification Label action support for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP Policies via the ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. Application. Enables bidirectional WebSocket traffic inspection across applications for security and data protection controls.
13 details in Everything
Zscaler launches Zero Trust Gateway for Google Cloud via native Network Security Integration, deployable in under 10 minutes.
Introduces Zscaler Zero Trust Gateway (ZTGW) for Google Cloud, integrating with Google Cloud's Network Security Integration (NSI) to transparently steer workload traffic to Zscaler for deep inspection without application changes, manual tunnels, or route table modifications. Supports Single VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. , Multiple VPC, and Shared VPC Google Cloud topologies, fitting into existing GCP network architectures. Uses Google Cloud Security Profiles and Profile Groups to control traffic steering to Zscaler, enabling policy-driven enforcement within GCP traffic flows. Provides unified visibility across GCP, other clouds, and on-premises environments through the Zscaler Admin Portal.
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-08-13
Aug 13, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure single-subscription onboarding, manual MIP labeling for file shares, saved views in Alerts/Data Duplication, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Overview dashboard, and Snowflake public int
Adds Azure single subscription onboarding to bypass tenant or management group restrictions Enables manual application of Microsoft Purview Information Protection (MIP) labels to on-premises and Azure file shares via the Data Inventory Introduces a new SaaS Overview dashboard within DSPM to visualize detected incidents, affected applications, and users Adds Saved Views capability for the Alerts and Data Duplications tables to persist custom filters and column settings Enhances the Snowflake database graph with a public internet node to show publicly exposed databases
5 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-08-12
Aug 12, 2026
· release notes
AI Guard expands to Copilot.com with request/response blocking and custom messages
Adds support for www.copilot.com in AI Guard to protect direct web browser interactions with Microsoft 365 Copilot Enables request and response blocking policies for Copilot.com traffic with support for custom user-facing messages
2 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-08-12
Aug 12, 2026
· release notes
Client Connector v4.8.0.252 for macOS adds India subcloud support and ICMP tunneling
Supports ind.zscalertwo.net as a value for the cloudName installation parameter to target the India subcloud. Enables tunneling of ICMP requests to domain-name-based Private Access apps in Transparent Proxy-based Interception mode.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-12
Aug 12, 2026
· release notes
ZIA adds HTTP/2 protocol support to Bandwidth Control policies.
Bandwidth Control now applies to HTTP/2 traffic in addition to existing protocols.
1 detail in Everything
Zscaler Cellular — Release Upgrade Summary (2026) — 2026-08-12
Aug 12, 2026
· release notes
Adds Location History widget to SIM details page
Client Connector — ZDX Module Release Summary (2026) — 2026-08-11
Aug 11, 2026
· release notes
ZDX Module 4.8.1.67 adds FIPS 140-3 FIPS 140-3 A US federal standard, maintained by NIST, that defines requirements for cryptographic modules used in government systems. Cyber tools target it to satisfy procurement mandates requiring validated crypto. compliance, Remote script decline UI, and enhanced TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. /probe logic
Supports FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-3 compliance standards and upgrades OpenSSL library to version 3.5.5. Adds a Decline button to the remote script’s end user notification configuration. Enhances TCP capabilities in Cloud Path probe configuration.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-08-11
Aug 11, 2026
· release notes
ZDX adds Resilient and Strict TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. types to Cloud Path probes with automatic default migration.
Adds Resilient and Strict TCP type options when configuring a Cloud Path probe in ZDX.
1 detail in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-08-10
Aug 10, 2026
· release notes
Zscaler Secure Access to AI Apps adds Copilot in Excel support via augloop.office.com URL configuration for request/response blocking
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-10
Aug 10, 2026
· release notes
ZPA adds LSS App Connector-based log streaming to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. servers during Business Continuity for private cloud deployments.
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-08-10
Aug 10, 2026
· release notes
Adds Filter Evaluation Time setting to historical dashboards and reports.
Introduces Current State and Historical State options for filtering in historical dashboard widgets and reports.
1 detail in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-08-07
Aug 7, 2026
· release notes
New AI Guard log export filter, Claude inference hook integration, CSV dashboard exports, and pattern detector limits.
Tools field is now filterable in Event Log Export configuration to exclude it from exported event logsIntegrates with Anthropic Claude's inference hooks to inspect and evaluate prompts against detection policies in real time Dashboard event tables now support CSV export alongside existing PDF export
3 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-08-07
Aug 7, 2026
· release notes
Secure Access to AI Apps adds Claude inference hook integration, prompt policy URL detection, and CSV exports
Adds Claude Inference Hook Integration allowing real-time Allow/Deny verdicts for Anthropic Claude prompts against tenant detection policies Enables Malicious URL Detection as a configurable category within prompt detection policies Increases Text (Pattern) detector regex limit to 100 patterns per policy (up from 10) Extends individual regex pattern length for the Text (Pattern) detector to 3,000 characters Adds CSV export support for Dashboard event tables alongside existing PDF
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-07
Aug 7, 2026
· release notes
Service updates deployed to private.zscaler.com and zpatwo.net on August 07, 2026.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-08-07
Aug 7, 2026
· release notes
ZDX release adds thirteen new geographic managed locations for monitoring, expanding coverage in Data Explorer filters.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-07
Aug 7, 2026
· release notes
ZIA adds bidirectional WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. inspection, new network app support, Jira label actions, and UI search filters.
Enables inspection of bidirectional WebSocket traffic to extend security controls. Adds support for identifying WARP, DOQ, DOH3, STOMP, and AMQP as network applications in Firewall Filtering. Adds Apply Jira Classification Label action for Data at Rest Scanning DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies via the Admin Console UI. Adds Go to File navigation action for Salesforce files in Assets Reports. Adds new search filters (Rule Status , Network Application Groups , Application Service Groups , Source Country , Destination Country , Source IPv6 Groups , Destination IPv6 Groups ) to the Firewall Filtering Policy page.
5 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-08-06
Aug 6, 2026
· release notes
Zscaler Workflow Automation adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. quarantine API endpoints and new notification merge tags.
Adds GET /dlp/v1/incidents/{dlpIncidentId}/quarantine/status endpoint to retrieve quarantine email release statuses (quarantined, failed, in progress, success) Adds POST /dlp/v1/incidents/{dlpIncidentId}/quarantine/release endpoint to asynchronously release quarantined emails for Email DLP incidents Adds GET /dlp/v2/incidents/{dlpIncidentId}/triggers endpoint providing enhanced nested DLP incident trigger metadata organized by source category Adds new merge tags Email Quarantine Status and Matched Files (file name + file size) to Email, Slack, and Microsoft Teams notification templates Adds time zone selection control for bulk Notify User and Escalate actions on the Incidents page
5 details in Everything
Zscaler AI Guard integrates with Claude inference hooks to enforce Zero Trust DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy natively at the model layer across Claude Enterprise.
Integrates Zscaler AI Guard with Anthropic Claude inference hooks to enforce Zero Trust data-loss-prevention policy natively at the Claude model layer, evaluating full conversation context in real time rather than individual messages. Extends existing Zscaler platform policies to Claude Enterprise touchpoints with no additional governance stack required — existing Zscaler customers can activate with their current policy configuration.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-08-05
Aug 5, 2026
· release notes
ZPA adds Zero Trust Browser isolation menu with clipboard restrictions notifications, file transfer tracking, debug logs export, and admin settings view.
Adds a Clipboard icon in the Zero Trust Mode menu to view restriction notification details when clipboard actions are blocked by admin profile. Adds temporary Download Completion notifications in the Zero Trust Browser allowing users to click View to locate files in Protected Storage. Adds the ability for end users to export isolation session logs directly from the Zero Trust Browser's Troubleshoot icon. Adds an Information icon in the Zero Trust Mode menu to display current admin-configured restrictions and disabled tools for the active isolation profile.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-08-05
Aug 5, 2026
· release notes
ZIA enhances end-user isolation UI with Protected Storage notifications and expanded Zero Trust Mode menu options across all clouds.
Adds Protected Storage icon and notification flow to the Zero Trust Mode menu for file transfer tracking Adds Clipboard sidebar in the Zero Trust Mode menu to display clipboard restriction notifications Adds Print, Troubleshoot, and Information icons to the Zero Trust Mode menu for isolation session management
3 details in Everything
Zscaler Zero Trust Branch now available in FedRAMP Moderate FedRAMP Moderate A US government authorization tier requiring cloud services to meet a defined set of NIST 800-53 controls before federal agencies can use them, giving cyber tools a pre-vetted compliance baseline for government contracts. and High, enabling secure distributed branch connectivity for civilian federal agencies.
Extends Zscaler Zero Trust Branch to FedRAMP FedRAMP A US government program that standardizes cloud security authorization, letting vendors get a single assessment accepted across federal agencies instead of repeating the process for each one. Moderate and High environments, giving civilian federal agencies and public sector organizations a compliant path to zero trust branch security. Supports CISA TIC 3.0 Branch Office Use Case with local breakout architecture, allowing branch users to access the web and agency-sanctioned CSPs directly without backhauling traffic. Provides device segmentation using a /32 per-device network approach (with variable subnet length support), acting as a DHCP server to discover and isolate every device at a branch site. Introduces a Ransomware Killswitch concept with color-coded policies, enabling teams to rapidly tighten enforcement during suspicious activity to limit lateral spread. Enables OT and IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. device discovery, tagging, and least-privilege policy enforcement to isolate cameras, badge systems, building management, and other hard-to-patch devices from user networks.
+2 more
show less
Supports one-arm mode alongside existing SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. or gateway mode to terminate multiple internet links and load balance traffic, with outbound-only tunnels to the Zero Trust Exchange eliminating publicly exposed routes. Offers zero-touch provisioning via the integrated Branch Appliance — define a site, activate the appliance, and it establishes secure outbound connectivity automatically.
7 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-08-03
Aug 3, 2026
· release notes
Client Connector 4.9.0.448/4.8.0.284/4.7.0.364 for Windows adds ind.zscalertwo.net subcloud support via cloudName; Linux release patches local privilege escalation privilege escalation Gaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. and RCE RCE Remote code execution, the ability to run attacker-chosen code on another system through a vulnerability. Its impact depends on the permissions and access that code receives. .
Supports using the ind.zscalertwo.net subcloud in the cloudName installation parameter for Zscaler Client Connector deployments in India.
1 detail in Everything
Deception — Release Upgrade Summary (2026) — 2026-08-03
Aug 3, 2026
· release notes
Zscaler Deception adds Gen AI decoy deployments, JA3 JA3 A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. /JA4 JA4 A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. fingerprints, CVE-2026-1603 detection, and SHA-256 SHA-256 A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. process IDs on macOS.
Adds one-click deployment of five new Generative AI (Gen AI) decoy profiles to the Zscaler Deception Admin Portal. Adds JA3 and JA4 network fingerprint support to event logs for web decoys in the Zscaler Deception Admin Portal. Adds support for data collection rule-based log ingestion for events and audit logs to align with Microsoft Sentinel SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. configurations. Adds SHA-256 process identification via macOS Landmine Agents for event data and safe process filtering. Adds Cisco ASA as a new high-interaction dataset.
5 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-31
Jul 31, 2026
· release notes
AI Guard DAS DAS Direct-Attached Storage: disks connected directly to a host machine rather than over a network, giving tools low-latency, high-throughput access to raw storage without SAN or NAS overhead. /API mode adds conversation threading in dashboard; US Gov ID Secrets policy options restricted
Adds multi-turn conversation stitching to the AI Guard Dashboard (DAS/API mode) so flagged interactions display as a unified thread instead of individual messages Restricts the US Government ID category in Secrets Detector policies to only Detect and Disable options, with automatic transition of existing BLOCK/ALLOW policies to Disabled mode
2 details in Everything
└──▷ BREAKING ON UPGRADE
! Policies configured with BLOCK or ALLOW for the US Government ID category automatically transition to Disabled mode when any Secrets policy configuration updates are applied
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-31
Jul 31, 2026
· release notes
Private Access now supports Canada as an isolation region in ZPA isolation profiles.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-31
Jul 31, 2026
· release notes
ZIA adds Canada region to Zero Trust Browser isolation profiles and new search filters for Firewall Filtering Policy rules
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-23
Jul 23, 2026
· release notes
New capability for deploying AI Red Teaming workers within customer infrastructure.
Zscaler adds Agentic SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. with closed-loop remediation and ZDX Network Intelligence for per-hop ISP visibility.
Introduces Agentic SecOps solution (limited availability) — an AI-driven security operations layer that connects telemetry across the Zscaler platform, endpoints/EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. , identity, and cloud to detect threats and orchestrate automated closed-loop remediation. Adds ZDX Network Intelligence dashboard with global route visualization color-coded by severity, enabling NetOps teams to pinpoint last-mile and transit ISP degradation across hybrid workforces. Enables BGP BGP A routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. Autonomous System Number (ASN ASN Autonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. )-level aggregation of probe telemetry within ZDX, surfacing per-ASN latency and packet loss to identify which carrier is responsible for user experience degradation. Adds hop-level drill-down within BGP ASNs in ZDX, showing per-hop latency and packet loss to identify specific routers or peering points causing problems. Introduces ZDX Peer Impact Analysis, providing cross-customer visibility into whether other Zscaler customers traversing the same ISP path are experiencing the same anomaly — confirming whether an issue is carrier-wide or organization-specific.
5 details in Everything
Zero Trust Branch — Release Upgrade Summary (2026) — 2026-07-21
Jul 21, 2026
· release notes
ZTB 8.1.2 adds DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. tunnels, hub deployments in AWS/Azure, Azure China support, ZPA log levels, IGMP IGMP A network-layer protocol used by IPv4 hosts and routers to manage multicast group membership, letting routers know which hosts want traffic for a given multicast address. /LLDP/BGP BGP A routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. filtering, HA weights, low-bandwidth mode, and Appliance Admin C
Added DTLS-based connectivity to Internet & SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. with automatic fallback to TLS Added support for deploying hub appliances in Microsoft Azure and Amazon Web Services (AWS) via ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. , VHD, and OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images Added support for China deployments including bootstrap, provisioning, and custom ZIA gateway selection Added support for the IGMP Querier on Layer 2 VLANs (IGMPv2/v3) Added support for configuring ZPA log levels on Zero Trust Branch appliances
+14 more
show less
Added support for both in-band and out-of-band management interfaces including loopback and VRF VRF A Virtual Routing and Forwarding instance is a router feature that maintains multiple independent routing tables on one device, letting a cyber tool isolate traffic flows or simulate separate network segments without extra hardware. isolation Added support for LLDP on Zero Trust Branch interfaces to discover neighboring devices Added support for BGP route filtering using import and export maps Added real-time and historical system and WAN health monitoring with on-demand speed tests Added weight-based high availability (HA) with interface tracking Added interface utilization metrics, throughput calculations, and manual speed/duplex/MTU configuration in the UI Added Appliance Admin Console, a command-line interface for appliance management and troubleshooting Added low bandwidth mode for Zero Trust Branch appliances Added DHCP Address Conflict Detection before lease assignment Added per-VLAN DHCP profile support Added support to associate Branch Connector groups with Zero Trust Branch sites Added support for Internet & SaaS and Private Access sublocations with traffic labeling Added ENTITY-MIB support for SNMP SNMP A UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. host-level metrics Added Comment field for static routes, bulk CSV upload for networks/MACs, forwarding policy cloning, Ransomware Kill Switch filtering, read-only system default groups view, and Appliance Inventory page
19 details in Everything
└──▷ BREAKING ON UPGRADE
! If the management interface was reachable in existing versions via LAN or WAN, the management IP address becomes unreachable after the upgrade as it is moved to a separate VRF instance.
Risk360 — Release Upgrade Summary (2026) — 2026-07-20
Jul 20, 2026
· release notes
Zscaler Risk360 adds External Attack Surface risk factors for web apps via 3rd-party connectors
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-20
Jul 20, 2026
· release notes
ZPA adds step-up auth for PRA, Adaptive Access Engine support in diagnostics/policies, and B2B Federation capabilities.
Adds conditional access support for step-up authentication to Privileged Remote Access (PRA) users via the Admin Console Adds filtering of User Activity diagnostics by user profiles and adaptive access device profiles Adds Adaptive Access Profiles as a configurable criteria when creating access policies in the Admin Console Adds Partner Federation request management and federated partner trust configuration via the ZPA cloud service API
4 details in Everything
Zscaler launches Zero Trust Enterprise Browser and Browser Detection and Response (BDR) extension to bring Zero Trust into the browser itself.
Introduces Zero Trust Enterprise Browser: a purpose-built, fully managed Chromium browser with Zero Trust security integrated directly into the browsing experience. Adds Browser Detection and Response (BDR) via the Zero Trust Browser Extension, delivering browser-native threat detection and response inside existing browsers for threats that evade upstream network and endpoint controls. Delivers three Zero Trust Browser deployment form factors — Cloud Browser Isolation, Browser Extension, and Enterprise Browser — allowing organizations to mix and match based on user, device, and workflow requirements.
3 details in Everything
AI Asset Management — Release Upgrade Summary (2026) — 2026-07-17
Jul 17, 2026
· release notes
AI Asset Management adds six new AWS Bedrock Agent security policies for detection.
AWS Bedrock Agent has default orchestration template policy availableAWS Bedrock Agent does not have guardrails attached policy availableAWS Bedrock Agent is using default post-processing template policy availableAWS Bedrock Agent is using default pre-processing template policy availableAWS Bedrock Agent has guardrails encrypted with platform-managed key policy available
+1 more
show less
AWS Bedrock Agent has session encrypted with platform-managed key policy available
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-16
Jul 16, 2026
· release notes
App Connector groups can now be edited directly from the 'Where are my apps being served from?' page.
Adds in-app editing of App Connector groups to resolve unknown app hosting and location details.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-07-16
Jul 16, 2026
· release notes
ZDX RUM RUM Real User Monitoring — a technique that collects performance and behaviour data from actual users' browsers or clients in production, giving cyber tools visibility into real-world latency and errors rather than synthetic test results. browser extension v0.1.37 adds remote address, transfer size, and request header content length metrics.
Zscaler launches Autonomous Application Shield to auto-apply app-specific protections in the patch gap via App Connectors and global threat intel.
└──▷ HOW TO FIND IT
Request early access to Autonomous Application Shield to get hands-on experience and direct roadmap input before general availability.
📍 In the Zscaler console, contact your Zscaler representative or register via the Early Access Program webinar link to enable Autonomous Application Shield for your private applications.
New Autonomous Application Shield capability continuously assesses private application exposure via App Connectors and automatically applies per-app protections in the Zscaler cloud without requiring a patch. Per-application protection reasoning: the Zscaler cloud evaluates each private application individually and applies only the controls that specific application needs, reducing false positives and performance impact. Automatic protection adaptation when developers ship new releases — security policy updates without manual re-tuning, policy review meetings, or security team intervention. Global threat intelligence integration feeds zero-day zero-day A vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. and emerging attack technique data from Zscaler's worldwide customer base into the protection engine, with ML continuously tuning policies per application.
4 details in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-07-15
Jul 15, 2026
· release notes
Zscaler Authentication Service adds tenant creation support in the India region
Client Connector — Client Connector App Release Summary (2026) — 2026-07-15
Jul 15, 2026
· release notes
Client Connector 4.8.0.221 for macOS allows VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass to exclude subdomains and adds disableFirewallHealthCheck MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. flag.
Updates the VPN Gateway Bypass to optionally not bypass subdomains for FQDNs. Provides the Mobile Device Management (MDM) flag disableFirewallHealthCheck to ignore the results of route-based tunnel echo health checks.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-14
Jul 14, 2026
· release notes
ZPA App Connectors and edges now support journalctl for remote log collection.
Enables the journalctl command on ZPA App Connectors, Private Service Edges, Private Cloud Controllers, and Network Connectors to collect service or system logs remotely.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-13
Jul 13, 2026
· release notes
ZPA adds Get Network Interfaces command for App Connectors and remote network settings configuration
Adds the Get Network Interfaces command to collect a list of network interfaces used by an App Connector Enables remote configuration of network settings for App Connectors, including enabling SSH on the OS and updating software interface settings across VMs
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-13
Jul 13, 2026
· release notes
ZIA adds Nutanix platform support for Virtual Service Edge deployment via downloadable VM image.
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-07-13
Jul 13, 2026
· release notes
New ZTGW API endpoints and L4 ingress/SNAT/DNAT support for Cloud & Branch Connector
Adds GET /ztGateway, POST /ztGateway, PUT /ztGateway/{id}, and other Zero Trust Gateway API endpoints for programmatic management of gateways, configuration, and traffic tests. Enables L4 Ingress support with SNAT and DNAT capabilities across AWS, Azure, and GCP. Adds Terraform support for Azure Gateway Load Balancer integration.
3 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-07-10
Jul 10, 2026
· release notes
Adds tenant restriction for personal/enterprise accounts and streaming response inspection for M365 Copilot in Secure Access to AI Apps.
Adds tenant restriction feature for Anthropic and OpenAI to separate access-control rules for personal vs enterprise accounts Adds streaming response inspection support for Microsoft 365 Copilot across Web, Desktop, Word, and Outlook apps
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-07-10
Jul 10, 2026
· release notes
ZPA adds automatic isolated session restore and new microsegmentation platform support
Agents on Windows now exclude infrastructure traffic (loopback IP addresses) from flow logs Microsegmentation now supports Ubuntu 26.04 LTS Microsegmentation now supports Microsoft Windows Server 2025
3 details in Everything
AI Asset Management — Release Upgrade Summary (2026) — 2026-07-10
Jul 10, 2026
· release notes
Zscaler AI Asset Management adds outbound REST APIs REST APIs A convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. and OpenAPI OpenAPI A vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. portal for programmatic asset access
Adds an outbound REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for AI asset management to programmatically access inventory and governance data Adds a self-service API documentation portal with an OpenAPI 3.1 (Swagger) interface
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-10
Jul 10, 2026
· release notes
Adds Snowflake platform support in Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. and new NSS enum values for 3rd-Party App Governance logs.
Adds POSTURE_CONTROL and APP_GOVERNANCE values to the nssLogType field in the ZmanageNssFeed model for the /nssFeeds API Enables Snowflake as a configurable platform in Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) Adds 3rd-Party App Governance and Posture Management log streaming support via Nanolog Streaming Service (NSS)
3 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-09
Jul 9, 2026
· release notes
New MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Security Ratings catalog in Zscaler AIRT to assess risk of public MCP servers
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-07-09
Jul 9, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds data duplication reporting for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. , new AI posture policies, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine selection, saved views, and unified dashboard deep-links.
Adds Data Duplication Report tab to identify identical files across M365, JIRA, Google Drive, Salesforce, on-prem file shares, and cloud services. Adds new AWS Bedrock and Azure AI Foundry/OAI data posture policies that flag resources containing sensitive data without required tags. Enables selection of specific DLP engines for DSPM scans via Zscaler Admin Console to reduce noise from other channel engines. Adds Saved Views capability in Data Inventory and Resource Inventory to persist custom column visibility and filter settings. Adds Entity Source, Entity Category, and Target Environment columns to Identity Inventory, plus category/source/cloud provider filters.
+1 more
show less
Adds deep-link navigation in the Unified Dashboard's Top Sensitive Data At Rest section to the Data Inventory for public cloud and on-prem files.
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-09
Jul 9, 2026
· release notes
ZIA adds posture controls for Power Apps, Power BI, Purview and Viva Engage in Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. .
Private Access (ZPA) — App Connector Release Summary (2026) — 2026-07-09
Jul 9, 2026
· release notes
App Connector 26.55.1 adds configurable pattern matching for application segments with AppProtection enabled
AI Asset Management — Release Upgrade Summary (2026) — 2026-07-08
Jul 8, 2026
· release notes
New ACR discovery support, cross-console navigation, multi-cloud toggle, and AI infra scan logs in AI Asset Management.
Adds automatic discovery and cataloging of Azure Container Registry (ACR) repositories and container images for AI security visibility Enables direct navigation from the AI Security console to corresponding resources in CSP CSP Content Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. consoles for MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers, Agents, Data Stores, Workloads, Guardrails, and Identities Introduces a Multi-Cloud Toggle in the AI Security Admin Portal to switch between cloud environments (AWS, Azure, GCP) within a single interface Adds a System Logs page with an AI Infra Scanning tab for unified, filterable view of scan events and error messages across AWS, Azure, and GCP
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-07-06
Jul 6, 2026
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds data duplication reports for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. , new AWS/Azure posture policies, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine selection per channel, and saved views.
Adds the Data Duplications tab and report to identify identical files across cloud services, on-premises shares, and SaaS services (M365, JIRA, Google Drive, Salesforce) for DSPM + CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. subscriptions Introduces five new AWS and Azure data posture policies targeting untitled sensitive data in AWS Bedrock, Azure AI Foundry Hub, and Azure OpenAI accounts Adds Identity Inventory columns: Entity Source , Entity Category , and Target Environment to help filter identities by provider and type Enables Saved Views in the Data Inventory and Resource Inventory tables so users can persist custom column visibility and filters Allows selecting specific Zscaler DLP engines for the DSPM channel via the Zscaler Admin Console to reduce noise from other channels
+1 more
show less
Adds clickable links in the Top Sensitive Data At Rest section of the Unified Dashboard that navigate directly to the Data Inventory
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-06
Jul 6, 2026
· release notes
ZIA adds domain fronting exemptions, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. log fields, NSS for 3rd-party app logs, and new SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls for Microsoft 365.
POSTURE_CONTROL and APP_GOVERNANCE values added to the nssLogType field in the ZmanageNssFeed model via the /nssFeeds APINew UI options under Policies > Common Configuration > Advanced > Advanced Settings > Domain Fronting: URL Category Exemptions for Block Domain Fronting and Exempted Cloud Applications for Block Domain Fronting Fields %s{dlp_policy_action} and %s{dlp_confirm_justification_msg} added to NSS/Cloud NSS Feed Output Format for Web logs; %s{dlp_confirm_justification_msg} added for Endpoint DLP logs Advanced SSPM posture controls added for Microsoft Power Apps, Microsoft Power BI, Microsoft Purview, and Microsoft Viva Engage
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-07-06
Jul 6, 2026
· release notes
Adds API endpoints for Zero Trust Gateways and L4 ingress support with SNAT/DNAT to Cloud & Branch Connector
Adds programmatic management of Zero Trust Gateways via new REST endpoints including GET /ztGateway, POST /ztGateway, PUT /ztGateway/analytic/metrics/{id}, and others for configuration, status, events, and traffic testing. Adds Layer 4 (L4) ingress support for Cloud & Branch Connector with Source Network Address Translation (SNAT) and Destination Network Address Translation (DNAT) capabilities in AWS, Azure, and GCP. Adds support for Azure Gateway Load Balancer via Terraform provider within the Cloud & Branch Connector.
3 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-07-03
Jul 3, 2026
· release notes
Adds AI Red Teaming Broker for private apps, Detection Level setting, and policy import with Tenant ID
Introduces the AIRT Broker feature to establish inside-out connectivity for AI Red Teaming without firewall changes, managed via the Administration > Red Teaming > Brokers page. Adds a Detection Level setting in probe configuration allowing security teams to control probe sensitivity with Strict, Moderate, or Permissive options. Adds an AI Guard Tenant ID field to the Import Policy pop-up for AI Red Teaming integration with Zscaler AI Guard. Adds a Rerun action at the test run level in AI Red Teaming to resume incomplete or failed probes without restarting the full assessment.
4 details in Everything
Risk360 — Release Upgrade Summary (2026) — 2026-07-02
Jul 2, 2026
· release notes
Adds Application End-of-Life and End-of-Support risk factors to the Compromise category in Zscaler Risk360.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-07-02
Jul 2, 2026
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. data duplication reports, new AI/ML posture policies, identity inventory enhancements, saved views, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine selection, and dashboard links.
Data Duplications Report and Data Duplications tab for identifying identical files across SaaS services (M365, JIRA, Google Drive, Salesforce) on subscriptions with DSPM and CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. New data posture policies for AWS Bedrock models/knowledge bases and Azure OpenAI/AI Foundry Hub detecting untagged sensitive data Identity Inventory columns: Entity Source , Entity Category , and Target Environment for filtering identities by category, source, and cloud providerSaved Views functionality in Data Inventory and Resource Inventory to persist custom filters and column visibilityAbility to select specific Zscaler DLP engines for DSPM scanning (enabling/disabling DSPM channel per engine in Admin Console)
+1 more
show less
Clickable links in the Top Sensitive Data At Rest section of the Unified Dashboard to navigate directly to files/tables in the Data Inventory
6 details in Everything
AI Asset Management — Release Upgrade Summary (2026) — 2026-07-01
Jul 1, 2026
· release notes
Enhanced Identity Inventory adds Access Category, Target Environment, and Source Environment filters and columns to the Identities page
Adds Access Category column to categorize identities by access type and AI usage on the AI Infrastructure > AI Resources > Identities page
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-07-01
Jul 1, 2026
· release notes
ZIA adds Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. posture controls for Power Apps, Power BI, Purview, and Viva Engage; first release of Enterprise Browser for Zero Trust Browser.
Adds Advanced SSPM posture controls for Microsoft Power Apps, Power BI, Purview, and Viva Engage via the M365 connector First release of Enterprise Browser for Zero Trust Browser (dedicated hardened Chromium) across zia, zscalerone, zscalertwo, zscalerthree, zscloud, and zscalerbeta clouds
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-30
Jun 30, 2026
· release notes
ZIA now supports custom Application Service Groups via new UI columns and API endpoints
Adds ability to define custom application service groups in the ZIA console when Advanced Firewall is enabled Adds Definition column and filtering capabilities for application service groups in the UI Adds new Cloud Service API endpoints (GET /apps-services, POST /apps-services, etc.) for managing custom application service groups programmatically
3 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-06-29
Jun 29, 2026
· release notes
Secure Access to AI Apps adds prompt allowlists, Windsurf provider support, and UI improvements for detections.
Adds Prompt Allowlist functionality to AI Guard for tracking and managing allowed prompts with end-to-end encryption. Supports Windsurf as a new AI provider in ZIA.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-06-29
Jun 29, 2026
· release notes
Adds OS selection filter for ZDX end user probes and collection configurations
Configuring a probe in the Probing Criteria now supports filtering by selected Operating Systems. End user collection configurations in ZDX can now specify target OSs.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-29
Jun 29, 2026
· release notes
ZIA adds Microsoft Power Apps, Purview etc. posture controls in SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. and API endpoints for custom application service groups.
Adds Advanced SaaS Security Posture Management posture controls for Microsoft Power Apps, Power BI, Purview, and Viva Engage via the M365 connector Enables creation of custom Application Service Groups visible in the Definition column on the Application Services page Updates Forwarding Policy, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control Policy, and Firewall Filtering Policy to support predefined (AU) and custom (CU) application service groups Adds GET /apps-services, POST /apps-services, GET /apps-services/{appServiceId}, PUT /apps-services/{appServiceId}, and DELETE /apps-services/{appServiceId} endpoints to the Cloud Service API for managing custom application service groups
4 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-06-29
Jun 29, 2026
· release notes
Adds Mapping Copilot, an AI-guided assistant for data source mapping in the SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Platform
Introduces Mapping Copilot , an AI-powered mapping assistant available via chat interface on data source mapping pages to provide context-aware recommendations, target entity identification, key field mapping, and complex transformation scripts.
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-06-26
Jun 26, 2026
· release notes
Zscaler Workflow Automation adds Notify node configuration wizard and time zone selection for notifications (June 26, 2026)
Adds a conversation-based Configure Notify Node window on the custom workflow builder page to assist with configuring user or escalation notifications. Enables time zone selection for time-related merge tags on notifications created via Incident Details page, custom workflow builder, Notification Template page, or Admin Assignment window (defaults to UTC+00:00 if not set).
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-26
Jun 26, 2026
· release notes
ZIA adds domain fronting exemptions and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. log fields to NSS feeds.
Adds URL Category Exemptions for Block Domain Fronting option in Advanced Settings to exempt specific URL categories from blocking Adds Exempted Cloud Applications for Block Domain Fronting option in Advanced Settings to exempt cloud app categories or apps Adds DLP Policy Action filter and column to Web Insights Logs and Endpoint DLP Insights Logs Adds DLP Confirmation Message filter and column to Web Insights Logs and Endpoint DLP Insights Logs Adds %s{dlp_policy_action} field to NSS and Cloud NSS feed output formats for web logs
+4 more
show less
Adds %s{dlp_confirm_justification_msg} field to NSS and Cloud NSS feed output formats for web logs Adds %s{dlp_confirm_justification_msg} field to NSS and Cloud NSS feed output formats for Endpoint DLP logs Adds Unclassified and Under Review labels in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Report for application classification Displays certificate validity, WAF WAF A reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. name, CVE ID, and breach URL in the SaaS Security Report for cloud applications
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-25
Jun 25, 2026
· release notes
ZIA adds per-template Caution Interval setting to Browser End User Notifications
AI Asset Management — Release Upgrade Summary (2026) — 2026-06-24
Jun 24, 2026
· release notes
AI Asset Management adds GitHub integration for code repos, embedded AI app visibility, and new dashboard widgets.
Administration > Account Onboarding flow added to connect GitHub as a Code Repository provider for automated discovery of AI models and workflows in source codeAutomated discovery capability now maps all discovered repositories to the Default Business Unit by default, with post-discovery reassignment support Granular scan rule configuration available to control which connected repositories are scanned for embedded AI components Public AI Overview page adds Upload Volume , Download Volume , and Embedded AI Apps widgets while removing Sensitive Data and Sensitive Data Transactions widgets Locations tab introduced on the Usage Insights page to drill down into AI usage data by geographic location
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The Sensitive Data and Sensitive Data Transactions widgets are removed from the Public AI Overview page
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-24
Jun 24, 2026
· release notes
ZIA adds Unclassified and Under Review application status labels and enriched security attributes to the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Report.
Adds Unclassified and Under Review values for Application Status in the SaaS Security Report instead of defaulting to Unsanctioned Expands SaaS Security Report to display certificate validity, WAF WAF A reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. name, CVE ID, and breach URL next to Yes/No signals Adds a Caution Interval drop-down menu to Browser EUN Template configuration for custom caution timing
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-23
Jun 23, 2026
· release notes
ZPA adds Device Posture failure notifications, App Connector health API, and new VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. diagnostics dashboards
Adds Device Posture Profile Failure Notification configuration via the Manage Notifications button in the Add Access Policy UI Adds a new Event Monitoring & Notification API service to monitor App Connector health diagnostics (CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. , memory, disk, bandwidth, etc.) Adds an Access Policy Data Diagnostics page for viewing VPN access policy logs and diagnostic data Adds a Traffic Flow Logs Diagnostics page for viewing VPN connection traffic flow logs Adds a User Logs Diagnostics page for viewing VPN user connection logs
+1 more
show less
Adds a VPN Service Edges Dashboard showing connector counts and total data transfer
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-23
Jun 23, 2026
· release notes
ZIA adds custom application service groups, new UI columns, and associated REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints.
Adds GET /apps-services, POST /apps-services, GET /apps-services/{appServiceId}, PUT /apps-services/{appServiceId}, and DELETE /apps-services/{appServiceId} to the cloud service API for managing custom application service groups Adds Definition column and filter controls to the Application Services page UI for viewing, editing, and filtering custom groups Expands Forwarding policy, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control policy, and Firewall Filtering policy configurations to select custom (CU) application service groups
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-22
Jun 22, 2026
· release notes
ZIA introduces custom application service groups with API endpoints and policy integration
Adds ability to create custom Application Service Groups in the UI via the Definition column when Advanced Firewall is enabled Allows Forwarding, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, and Firewall Filtering policies to select custom (CU) application service groups Adds REST endpoints GET, POST, PUT, DELETE /apps-services for managing custom application service groups
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-19
Jun 19, 2026
· release notes
ZIA adds Snowflake SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. integration, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. channel selection, domain profile API endpoints, and browser EUN caution intervals
Adds GET /domainProfiles, POST /domainProfiles, GET /domainProfiles/{id}, PUT /domainProfiles/{id}, and DELETE /domainProfiles/{id} to the Cloud Service API for domain profile management Adds support for Snowflake as an API-Based Platform in Advanced SSPM, including visibility into posture misconfigurations via the SSPM Scan checkbox during tenant onboarding Adds ability to select specific channels (e.g., Endpoint DLP, DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. ) for custom and predefined DLP engines to reduce unnecessary noise Adds a Caution Interval drop-down menu in the Administration > End User Notifications > Browser > EUN Templates > Add Custom Message window to configure per-browser caution intervals
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-06-18
Jun 18, 2026
· release notes
ZDX now allows rescheduling device remediation jobs directly from the UI for targeted devices.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-18
Jun 18, 2026
· release notes
ZIA adds per-browser EUN template caution interval configuration
Adds Caution Interval drop-down menu in Administration > End User Notifications > Browser > EUN Templates > Add Custom Message window to configure different caution intervals for different browser EUNs
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-17
Jun 17, 2026
· release notes
ZPA adds LSS log receiver configuration at the Microtenant level in Limited Availability
Adds ability to configure and manage Log Streaming Service (LSS) receivers directly within Microtenants on both private.zscaler.com and zpatwo.net platforms
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-06-17
Jun 17, 2026
· release notes
ZDX adds Device Remediation capability for Standard and Advanced subscriptions.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-17
Jun 17, 2026
· release notes
ZIA adds per-template Caution Interval drop-down for Browser EUN Templates
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-06-15
Jun 15, 2026
· release notes
New auth method for the GitHub connector reduces exposure via short-lived, org-scoped tokens.
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-06-15
Jun 15, 2026
· release notes
AEM adds GitHub App installation token auth for central, scoped repo access
Adds GitHub App installation token authentication to the GitHub Repositories connector, enabling centralized, least-privilege org-level access with short-lived tokens. Enables scope-specific repository access via the new GitHub App integration method.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-12
Jun 12, 2026
· release notes
ZPA Resource Policy rules now support Application Catalog port selection and manual TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port ranges for microsegmentation
Adds the Application Port Template option in Resource Policy rules to select destination ports directly from the Application Catalog.
1 detail in Everything
AI Asset Management — Release Upgrade Summary (2026) — 2026-06-12
Jun 12, 2026
· release notes
Zscaler AI Asset Management adds AWS Bedrock activity-based detection, report exports across pages, and Microsoft Copilot Studio integration
Adds activity-based detection for AWS Bedrock models using CloudTrail CloudTrail AWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. events to include only those accessed in the preceding 90 days. Enables report export on AI Assets (Models, MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. Servers, Agents) and AI Resources (Data Stores, Workloads, Guardrails, Identities) pages. Adds Microsoft Copilot Studio support for automated agent discovery, security posture assessment, and entitlement visibility.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-12
Jun 12, 2026
· release notes
ZIA introduces custom application service groups, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. channel scoping, and new domain profile APIs
Adds GET /apps-services, POST /apps-services, GET /apps-services/{appServiceId}, PUT /apps-services/{appServiceId}, and DELETE /apps-services/{appServiceId} endpoints to manage custom application service groups via API Adds new UI columns (Definition, view/edit/filter controls) on the Application Services page to define and manage custom application service groups when Advanced Firewall is enabled Adds Channels selection capability when creating, editing, or cloning DLP engines to scope them to specific channels like Endpoint DLP or DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. Adds GET /domainProfiles, POST /domainProfiles, GET /domainProfiles/{id}, PUT /domainProfiles/{id}, and DELETE /domainProfiles/{id} endpoints for domain profile management via API
4 details in Everything
Secure AI Apps & Infrastructure — Release Upgrade Summary (2026) — 2026-06-08
Jun 8, 2026
· release notes
Zscaler AI Security adds standalone prompt hardening for shadow apps and in-UI RAG RAG Retrieval-augmented generation: looking up relevant documents and adding them to the prompt before the model answers. It grounds responses in private or current data without retraining. progress indicators
Adds standalone App Hardening enabling manual application registration via AI Infrastructure > Remediation page for unmanaged applications without standard onboarding. Removes mandatory probe prerequisite for prompt hardening, allowing baseline hardening instructions to be activated immediately upon onboarding. Adds visual progress indicator and background processing for RAG initiation from the App Configuration page.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-08
Jun 8, 2026
· release notes
ZPA adds support for configuring AppProtection alongside Multimatch in application segments.
AppProtection and Multimatch can now be configured for the same application segment
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-08
Jun 8, 2026
· release notes
ZIA adds Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. coverage for Box with 4 new controls
Zero Trust Branch — Release Upgrade Summary (2026) — 2026-06-08
Jun 8, 2026
· release notes
Zero Trust Branch 8.0.8P5 adds admin password change via console and manual IPSec endpoint config.
Adds option to change the admin password using the Zscaler Admin Console Adds option to change the IPSec remote endpoint (previously automatic) via configuration
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-06-05
Jun 5, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. data inventory, on-prem SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. entitlement scanning, new AWS/Azure/GCP posture policies, VM directory excludes, Databricks catalog selection, and Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. auth fo
Adds SaaS data findings to the Data Inventory report for Out-of-Band CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. subscribers Adds on-premises SMB file share scanning with LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. -based identity entitlement detection Adds 18 new data posture policies for AWS, Azure, and GCP tagging/labeling of sensitive data Adds VM folder/directory exclusion paths in scan rules for AWS, GCP, and Azure virtual machines Adds Databricks catalog selection within workspace scan rules for granular discovery
+2 more
show less
Adds evidence snippet storage to customer-managed cloud storage for on-premises scans Adds Kerberos authentication support for scanning On-Premises NetApp NFS and SMB shares
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-05
Jun 5, 2026
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. channel scoping and new Domain Profile API endpoints
GET /domainProfiles, POST /domainProfiles, GET /domainProfiles/{id}, PUT /domainProfiles/{id}, DELETE /domainProfiles/{id} endpoints for Domain Profiles in Cloud Service APIChannel filtering for DLP engines (e.g., Endpoint DLP, DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. ) via the DLP Engines page
2 details in Everything
Zscaler Cellular — Release Upgrade Summary (2026) — 2026-06-05
Jun 5, 2026
· release notes
The Zscaler Cellular admin interface now includes Audit Logs for tracking configuration changes and administrative actions.
Client Connector — Client Connector App Release Summary (2026) — 2026-06-04
Jun 4, 2026
· release notes
Adds httpAuthAllowedHosts config parameter to support SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. redirect authentication
Supports the httpAuthAllowedHosts configuration parameter to allow redirected hostnames to be added to the exception list for SAML-based IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. authentication.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-04
Jun 4, 2026
· release notes
ZIA adds Endpoint Context UI/API and JA4 JA4 A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. logging capabilities for encrypted traffic visibility
Adds new API endpoints GET /endPointApplications/customApps, POST /endPointApplications/customApp, PUT /endPointApplications/customApp/{id}, DELETE /endPointApplications/customApp/{id}, GET /endPointApplications/customApps/{id}, GET /endPointApplications/customApps/lite, GET /endPointApplications, GET /endPointApplications/lite, PUT /endPointApplications/{id}, GET /endPointApplications/cloudApps, GET /endPointApplications/policies, GET /endPointApplications/getCategoriesWithNonEmptyApps, GET /endPointApplications/count, GET /endPointApplications/cloudApps/count for managing endpoint application resources. Adds new API endpoints GET /endPointApplicationGroups, POST /endPointApplicationGroups, GET /endPointApplicationGroups/{id}, PUT /endPointApplicationGroups/{groupId}, DELETE /endPointApplicationGroups/{id}, PUT /endPointApplicationGroups/resources/{groupId}, GET /endPointApplicationGroups/policies for managing endpoint application tag groups. Adds new model attributes endPointApplications, endPointApplicationGroups, endPointApplicationThreatLevels, and excludeContextShieldEndPoint to SSLInspectionRule, FirewallFilteringRule, and FirewallDnsRule policy models to enable endpoint-based conditions. Adds UI pages Application Investigation , Overview , and Inventory under Policies > Cybersecurity > Endpoint Context for endpoint application visibility. Adds new columns and filters JA4 Fingerprint , JA4 Fingerprint A , JA4 Fingerprint B , and JA4 Fingerprint C to Web Insights Logs.
+1 more
show less
Adds field %s{ja4_str} to NSS Feed Output Format for web logs to stream JA4 network fingerprints.
6 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-06-03
Jun 3, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. data inventory, on-prem SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. scanning with LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. /Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , and 20 new tagging policies across AWS/Azure/GCP
Adds unified SaaS data findings in the Data Inventory report for customers subscribed to Out-of-Band CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. . Adds on-premises SMB file share scanning to detect identities (users, groups, computer accounts) accessing sensitive data. Adds LDAP server registration requirement for on-premises file server association in DSPM. Adds Kerberos authentication support for NetApp NFS and SMB file shares. Adds 20 new data posture policies enforcing tags on AWS (DynamoDB, RDS, S3) and labels on Azure/GCP storage/compute resources.
+3 more
show less
Adds file and directory path exclusion options in scan rules to omit specific VM directories from scans. Adds Databricks catalog selection within scan rules for granular data discovery control. Adds evidence snippet storage in customer-managed cloud storage for on-premises sensitive data findings.
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-03
Jun 3, 2026
· release notes
ZIA adds appInventory* filter fields to NSS /nssFeeds API and File Type Control rule expiration
appInventoryAppTypes, appInventoryThreatTypes, and appInventoryThreatCategories fields are available in the ZmanageNssFeed model for the /nssFeeds APIs to filter Application Inventory logs.Admins can now set an expiration date for File Type Control policy rules.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-02
Jun 2, 2026
· release notes
ZPA Private Cloud Controllers now support OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment (requires v25.47.3+) and updated STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -hardened images for Azure/GCP with FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. enabled.
Adds OAuth 2.0 enrollment support for Private Cloud Controllers, allowing devices to obtain OAuth tokens via the zpa-oauth.private.zscaler.com server instead of provisioning keys Updates App Connector, Private Service Edge, and Private Cloud Controller STIG-hardened VM images on Microsoft Azure with FIPS enabled by default Updates App Connector, Private Service Edge, and Private Cloud Controller STIG-hardened VM images on Google Cloud Platform (GCP) with FIPS enabled by default
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-06-01
Jun 1, 2026
· release notes
ZPA adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment for PSEs and redaction of sensitive text in isolation profiles.
Adds OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 enrollment support for Private Service Edges (PSEs) on private.zscaler.com and zpatwo.net clouds Allows admin to enable redaction of sensitive text in Zero Trust Browser isolation profiles
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-06-01
Jun 1, 2026
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. data inventory, on-prem SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. scanning with LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. /Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , Databricks catalog selection, and exclusion paths.
Adds unified Data Inventory reporting that includes SaaS data findings from Out-of-Band CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. subscriptions Adds Entitlement Findings support for on-premises SMB file shares to detect identities accessing sensitive data Adds Kerberos authentication support for scanning NetApp NFS and SMB file shares Adds ability to exclude specific VM folders or directories from scans by specifying file and directory paths in scan rules Adds Databricks Catalog Management to select specific catalogs within a workspace during scan rule configuration
+1 more
show less
Adds evidence collection for on-premises sensitive data stored in customer-managed cloud storage
6 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-06-01
Jun 1, 2026
· release notes
Android/Linux/ChromeOS Client Connector adds step-up auth, Z-Tunnel override, key export and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. PROXY support
Adds support for step-up authentication for conditional access to Zscaler Private Access (ZPA) and Zscaler Internet Access (ZIA) Enables overriding the Z-Tunnel 2.0 protocol settings Adds support for exporting the data-channel encryption key for debugging Z-Tunnel 2.0 traffic Adds support to use a PROXY return statement in the PAC file used with ZIA Disaster Recovery Configuration
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-06-01
Jun 1, 2026
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. justification logs to NSS feeds, Snowflake SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support, and text redaction in isolation profiles.
Adds %s{dlp_policy_action} and %s{dlp_confirm_justification_msg} fields to NSS/Cloud NSS Feed Output Format for web logs Adds %s{dlp_confirm_justification_msg} field to NSS/Cloud NSS Feed Output Format for Endpoint DLP logs Adds Snowflake as an API-based platform in Advanced SSPM with tenant onboarding via the SSPM Scan checkbox
3 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-05-30
May 30, 2026
· release notes
Secure Access to AI Apps adds Mistral Vibe (formerly Le Chat) as a supported provider for AI Guard.
Workflow Automation — Release Upgrade Summary (2026) — 2026-05-29
May 29, 2026
· release notes
Zscaler Workflow Automation adds notification template merge tags, incident attachments column, and CSV user data API endpoints.
Adds Sender Email and Subject merge tags to Notification Templates for email, Slack, and Microsoft Teams notifications Adds an Attachments column to the Incidents page incidents table to display file names for Source DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. type Email incidents Adds GET /dlp/v1/csv-user-data/{csv_user_data_uuid}/download endpoint to retrieve pre-signed S3 bucket links for CSV user attributes and validation errors Adds POST /dlp/v1/csv-user-data/import endpoint to import end user attributes as a multipart CSV file
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-29
May 29, 2026
· release notes
Private Access adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment support for Network Connectors
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-29
May 29, 2026
· release notes
ZIA adds URL category and cloud app exemptions for Block Domain Fronting policy.
URL Category Exemptions added to Advanced Settings to exempt specific URL categories from domain fronting blocksExempted Cloud Applications added to Advanced Settings to exempt specific cloud app categories or individual cloud apps from domain fronting blocks
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-05-29
May 29, 2026
· release notes
Zscaler Zero Trust Gateways now available in AWS ap-south-2 and ap-southeast-4 regions
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-28
May 28, 2026
· release notes
ZPA adds high-performance hardware appliances for App Connectors and Private Service Edges with 3+ Gbps throughput.
High-Performance Hardware Appliances for App Connectors and Private Service Edges are available in Limited Availability Updated AWS Images for Private Service Edge and Private Cloud Controller now ship STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -hardened RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 images with FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. enabled by default
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-26
May 26, 2026
· release notes
ZPA adds Business Continuity, Private Cloud, Controller Group, Version Profile, Enrollment Cert, and Browser Access Groups management APIs; supports external IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. selectio
Adds GET /mgmtconfig/v1/admin/customers/{customerId}/businessContinuitySettings, PUT .../BusinessContinuitySettings/{id}, GET .../metadata, and GET .../certificate endpoints for programmatic Business Continuity settings management Adds GET, POST, GET .../{privateCloudId}, PUT .../{privateCloudId}, and DELETE .../{privateCloudId} endpoints on /mgmtconfig/v1/admin/customers/{customerId}/privateCloud for Private Cloud Management Adds GET /mgmtconfig/v1/admin/customers/{customerId}/privateCloudController/{privateCloudControllerId} and PUT .../{privateCloudControllerId} for private Cloud Controller management Adds POST, DELETE, GET .../{privateCloudControllerGroupId}, DELETE .../{privateCloudControllerGroupId}, and PUT .../{privateCloudControllerGroupId} endpoints on /mgmtconfig/v1/admin/customers/{customerId}/privateCloudControllerGroup for controller group management Adds GET /mgmtconfig/v2/admin/customers/{customerId}/enrollmentCert endpoint for Enrollment Certificates retrieval
+4 more
show less
Adds GET /zpn/api/v2/admin/customers/{customerId}/lssConfig endpoint for Log Streaming (LSS) Configuration Adds GET /mgmtconfig/v1/admin/customers/{customerId}/visible/versionProfiles, GET .../versionProfile, GET .../appConnectorGroup, and GET .../serviceEdgeGroup endpoints for Version Profiles, App Connector Group, and Service Edge Group management Adds GET /mgmtconfig/v1/admin/customers/{customerId}/browserAccessGroups endpoint for Browser Access Groups Management Adds support to select the External IAM IdP when configuring a policy or a Microtenant
9 details in Everything
└──▷ BREAKING ON UPGRADE
! During migration, external IdP configurations are view only. After migration is complete, IdP configurations are inactive but can be restored if necessary.
Authentication Service — Release Upgrade Summary (2026) — 2026-05-26
May 26, 2026
· release notes
Authentication Service now supports migrating users from external IdPs.
Enables migration of end-users from external Identity Providers to Authentication Service.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-26
May 26, 2026
· release notes
ZIA adds API endpoints to manage Secure Message Processing Center (SMPC) instances and a new admin role permission.
Adds GET /smpcInstance and PUT /smpcInstance/dc API endpoints to update SMPC instance details by data center ID and retrieve status for all instances in a data center Adds ZS_BUSINESS_CONTINUITY enum value to the permissions field of the AdminRole model for the /adminRoles APIs
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-05-26
May 26, 2026
· release notes
A new data source mapping capability allows exploding JSON arrays to create individual records.
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-05-26
May 26, 2026
· release notes
AEM data source mapping now supports exploding JSON arrays for granular record creation
Adds support for exploding JSON structures in Data Source Mapping to create one output record per array element Allows mapping entire exploded objects or extracting unique nested keys across array elements
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-22
May 22, 2026
· release notes
ZPA Private Access adds animated loading cues and persistent checkmark indicator to Zero Trust Browser isolation experience.
Adds an animated green outline around the website border during Zero Trust Browser isolation page load Adds a floating checkmark icon that persists after the notification banner disappears to indicate the active session state
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-22
May 22, 2026
· release notes
ZIA adds Salesforce file restore, Private Access sandboxing sandboxing Running code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. , AI/ML source filtering, and expanded proxy/API endpoints
Adds POST /proxies endpoint to add up to 255 third-party proxies via API Adds GET /devices, GET /devices/{id}, GET /integrationPartners, GET /integrationPartners/crowdStrike/endpoints, POST /integrationPartners/crowdStrike/endpoints, and GET /integrationPartners/crowdStrike/whitelistedBaseUrls endpoints for device and partner data Adds POST /integrationPartners/microsoftDefender/endpoints endpoint to configure Microsoft Defender for Endpoint integration Adds GET /integrationPartners/sandbox/report/{md5} endpoint to retrieve Sandbox Detail Report MD5 hash Adds support for up to 200 MB EXE and DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. files in Advanced Sandbox
+8 more
show less
Enables sandboxing of unknown files uploaded to Private Access (ZPA) assets via Advanced Sandbox Adds AI/ML Detection Source filter and column to Web Insights Logs Adds Top AI/ML Detection Source by Security Incidents widget and AI/ML Detection Source field to Threat Incidents Analytics Adds AI/ML Detection Source filter for NSS/Cloud NSS feeds and %s{ai_ml_detection_src} field in Feed Output Format Adds support for Public, Private, and Communication site types on SharePoint Tenants Components page Adds Exempted DLP Identifier filter and column to Web Insights Logs for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scan timeouts Adds %d{exempt_dlpidentifier} field to NSS/Cloud NSS Feed Output Format Adds Restore remediation action in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Assets page to restore quarantined Salesforce files
13 details in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-05-21
May 21, 2026
· release notes
Adds NSS integration to stream Authentication Service logs to external SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-20
May 20, 2026
· release notes
ZPA adds FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. -enabled STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -hardened OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images for App Connector, Private Service Edge, and Private Cloud Controller on RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-18
May 18, 2026
· release notes
ZPA Private Access adds B2B Federation and LSS data types for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. traffic
Adds Support for Business-to-Business (B2B) Federation to enable cross-tenant collaboration and application sharing between ZPA customers Adds new user status and traffic flow data types to the Log Streaming Service (LSS) for VPN (For Legacy Apps)
2 details in Everything
Private Access (ZPA) — Private Cloud Controller Release Summary (2026) — 2026-05-18
May 18, 2026
· release notes
PCC v26.54.3 adds enhancements to global and custom policy groups for application access.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-18
May 18, 2026
· release notes
Adds Zscaler URL Category Test URLs for verifying HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. URL policy and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS Inspection validation
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-05-18
May 18, 2026
· release notes
Cloud Connector adds release channel selection and new ECGroup API endpoints for VM upgrade management.
└──▷ USE IT
Programmatically switch a Cloud Connector VM's upgrade path to the beta channel for testing.
api
copy
PUT /ecgroup/releaseChannel
Query current upgrade metrics and release channel state for a specific group of VMs.
api
copy
GET /ecgroup/vmUpgradeMetrics
Update the operational status of multiple virtual machines in a single API call.
api
copy
PUT /ecgroup/vmStatus
Adds stable, latest, and beta release channel options for Cloud Connector upgrades via the UI or provisioning templates Adds PUT /ecgroup/releaseChannel API endpoint to programmatically update the release channel for virtual machines Adds PUT /ecgroup/vmStatus API endpoint to update the status of virtual machines in bulk Adds GET /ecgroup/vmUpgradeMetrics API endpoint to retrieve the release channel and scheduled upgrade metrics
4 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-05-15
May 15, 2026
· release notes
Gemini CLI proxy support and Anthropic Bedrock user-mode traffic added to Zscaler AI Guard.
Adds Google Gemini CLI proxy mode support in AI Guard 2.16.0
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-15
May 15, 2026
· release notes
ZIA adds AI/ML detection source filtering, Sandbox for ZPA assets, Salesforce file restore, and new SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls
Adds adminScopeSupport query parameter to GET /groups and GET /groups/lite endpoints and USER_GROUP enum value to AdminScope/AlertDefinition scope fields. Extends Advanced Sandbox to analyze EXE and DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. files up to 200 MB for Internet & SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. traffic. Enables sandboxing sandboxing Running code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. of unknown files uploaded to Private Access (ZPA) assets for organizations with Advanced Sandbox. Adds AI/ML Detection Source filter, column, and field across Web Insights Logs, Threat Incidents table, Details tab, and NSS Cloud NSS feeds using %s{ai_ml_detection_src}. Displays SharePoint site type (Public, Private, Communication) for groups on the Manage SaaS Application Tenants > Components page.
+10 more
show less
Adds Exempted DLP Identifier filter and column to Web Insights Logs and %d{exempt_dlpidentifier} field to NSS Feed Output Format. Introduces Restore remediation action in the SaaS Security Assets page to restore quarantined Salesforce files. Increases third-party proxy and gateway limit to 255 via POST /proxies API and Admin Console. Adds cloud application instance support for Google Gemini and Microsoft Copilot. Adds Last Functionally Updated filter and Starting Prompt /'Ending Prompt' fields for Workday custom reports. Creates, updates, deletes, and retrieves Malware Protection policies via GET /malwarePolicy and PUT /malwarePolicy endpoints. Manages NSS Collector servers (CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. ) via GET /nssCollectors, POST /nssCollectors, PUT /nssCollectors/{id}, and DELETE /nssCollectors/{id}. Retrieves supported browser versions, updates Smart Browser Isolation, and manages Votiro CDR policies/tokens via new API endpoints under /browserControlSettings and /isolationVotiroCdr. Manages custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signature rules (CRUD, export/import, validation) via new endpoints under /ipsSignatureRules. Expands SSPM coverage for Bitbucket with 9 new controls, Confluence with 5, and Jira with 5.
15 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-14
May 14, 2026
· release notes
ZIA adds Bitbucket, Confluence, and Jira SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls to Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management.
Expands Advanced SaaS Security Posture Management (SSPM) coverage for Bitbucket with 9 new SSPM controls. Expands Advanced SaaS Security Posture Management (SSPM) coverage for Confluence with 5 new SSPM controls. Expands Advanced SaaS Security Posture Management (SSPM) coverage for Jira with 5 new SSPM controls.
3 details in Everything
Deception — Release Upgrade Summary (2026) — 2026-05-13
May 13, 2026
· release notes
Zscaler Deception adds SCADA/IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. datasets and protocols, granular safe process control, and new ThreatParse detection rules.
Adds DNP3DNP3 A serial and TCP/IP communication protocol used in industrial control systems, especially power grids and water utilities, to let control software poll and command field devices like sensors and switches. , IEC 61850, Profinet , and OPC UA protocol support for deploying SCADA/IoT decoys Adds static application datasets for Commvault, Grafana, IBM Maximo, Workday, Tableau, ActiveMQ, Splunk, Cisco FMC Adds SCADA/IoT decoy datasets: DNP3 Water Treatment RTU , IEC 61850 Substation Protection Relay , Oil & Gas Pipeline Compressor Station RTU , SIEMENS S7 1500 PLC, and ABB AC500 PLC Adds new ThreatParse rules for DNS reconnaissance, including DNS Active Directory SRV Record Reconnaissance , DNS ANY Record Enumeration , DNSSEC Probe and NSEC Zone Walk Attempt , DNS NS Record Enumeration , DNS NULL Record Query , DNS PTR Reverse Lookup , DNS SOA Record Enumeration , DNS Standard Record Enumeration (A/AAAA/HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. ), DNS TXT Record Query , DNS WPAD Query , and DNS Zone Transfer Attempt (AXFR AXFR A DNS zone transfer request that asks a nameserver to send every record in a zone at once, letting cyber tools enumerate all hostnames in a domain if the server is misconfigured to allow it. /IXFR) Adds granular safe process configuration by detection type and subtype for Windows and macOS Landmine agents
+1 more
show less
Updates Terraform user agent configuration for GCP decoy deployments to reduce false positive events
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-11
May 11, 2026
· release notes
ZIA adds 19 new SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls for Bitbucket, Confluence, and Jira to expand SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. security posture coverage.
Expands Advanced SSPM coverage for Bitbucket with 9 new controls Expands Advanced SSPM coverage for Confluence with 5 new controls Expands Advanced SSPM coverage for Jira with 5 new controls
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-05-11
May 11, 2026
· release notes
New API endpoints for programmatic release channel and status management, plus UI channel selection.
PUT /ecgroup/releaseChannel endpoint to update the release channel for VMsPUT /ecgroup/vmStatus endpoint to update the status of VMs in bulkGET /ecgroup/vmUpgradeMetrics endpoint to retrieve release channel and scheduled upgrade metricsUI support for selecting stable , latest , or beta release channels during Cloud Connector upgrades
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-08
May 8, 2026
· release notes
ZPA adds Agent Telemetry statuses and rule ordering for microsegmentation policies.
Adds new Agent Telemetry filter statuses including Forced Upgrade , In Progress with Failures , and Completed with Failures
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-05-08
May 8, 2026
· release notes
ZDX adds Decline button for scripted confirmations and renames Hosted Monitoring to Managed Monitoring with dashboard enhancements.
Adds Decline button option when configuring scripts with End-User Confirmation Adds ISP or ASN ASN Autonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. view to Network Intelligence dashboard based on probe count criteria
2 details in Everything
Internet & SaaS (ZIA) — Zscaler Endpoint DLP Release Summary (2026) — 2026-05-08
May 8, 2026
· release notes
Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. adds support for Japanese predefined DLP dictionaries on Windows and macOS
Adds Addresses (Japan), First Names (Japan), Full Names (Japan), and Last Names (Japan) to the list of supported predefined DLP dictionaries, enabling out-of-the-box detection for Japanese PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. without manual rule creation.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-08
May 8, 2026
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dict support for Japan, Gen AI prompt capture for QuillBot/Google, and new API endpoints for IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. /NSS/Malware.
Adds GET /malwarePolicy and PUT /malwarePolicy endpoints to retrieve and update the Malware Protection policy for an organization Adds GET, POST, PUT, and DELETE endpoints (/nssCollectors) to manage NSS Collector servers via API Adds support for Japanese predefined DLP dictionaries in Endpoint DLP policy rules: Addresses (Japan), First Names (Japan), Full Names (Japan), Last Names (Japan) Adds promptCaptureEnabled Boolean field to the WebApplicationRule model in /webApplicationRules API to control Gen AI prompt capture Adds enableQuillbotAIPrompt and enableGoogleAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings API
+6 more
show less
Adds GET /ipsSignatureRules, POST /ipsSignatureRules, PUT /ipsSignatureRules/{id}, DELETE /ipsSignatureRules/{id} endpoints for managing custom IPS signature rules Adds GET /ipsSignatureRules/export, GET /ipsSignatureRules/import, POST /ipsSignatureRules/import, and POST /ipsSignatureRules/validateRuleText endpoints for IPS rule export, import, and validation Adds browser version discovery via GET /browserControlSettings/supportedBrowserVersions and Smart Isolation policy updates via PUT /browserControlSettings/smartIsolation Adds Votiro CDR credential management via GET, PUT, DELETE /isolationVotiroCdr/tokenConfig and policy retrieval via GET /isolationVotiroCdr/policies Extends cloud application instance creation to Google Gemini and Microsoft Copilot Adds Instance Discovery Report support for Microsoft Azure with Domain, Tenant, and Resource levels
11 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-07
May 7, 2026
· release notes
ZIA adds Bitbucket, Confluence, Jira SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls and Workday filter support.
Expands Advanced SSPM coverage for Bitbucket with 9 new controls. Expands Advanced SSPM coverage for Confluence with 5 new controls. Expands Advanced SSPM coverage for Jira with 5 new controls. Adds Last Functionally Updated filter and Starting Prompt /'Ending Prompt' fields for Workday report parameters.
4 details in Everything
Risk360 — Release Upgrade Summary (2026) — 2026-05-05
May 5, 2026
· release notes
Risk360 adds 7 new Compromise risk factors for DNS traffic analysis including domain categories and tunnel detection.
Adds Blocking Critical DNS Domain Category factor under the Compromise category to quantify risk for DNS-based traffic. Adds Blocking High Risk DNS Domain Category factor under the Compromise category to quantify risk for DNS-based traffic. Adds Blocking Risky DNS Domain Category factor under the Compromise category to quantify risk for DNS-based traffic. Adds Blocking Critical DNS Tunnels factor under the Compromise category to quantify risk for DNS-based traffic. Adds Blocking High Risk DNS Tunnels factor under the Compromise category to quantify risk for DNS-based traffic.
+2 more
show less
Adds Blocking Risky DNS Tunnels factor under the Compromise category to quantify risk for DNS-based traffic. Adds Blocking Unknown DNS Traffic factor under the Compromise category to quantify risk for DNS-based traffic.
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-05
May 5, 2026
· release notes
ZIA expands Slack DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident forwarding to chat, adds SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls for Google Workspace, and supports new cloud app instances.
Enables forwarding of Slack chat-based DLP policy incidents to Zscaler Incident Response and Zscaler Workflow Automation Expands Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) coverage for Google Workspace with 24 new controls Adds Cloud Application Instances support for Google Gemini and Microsoft Copilot
3 details in Everything
Risk360 — Release Upgrade Summary (2026) — 2026-05-04
May 4, 2026
· release notes
Adds File Upload Inspection and Clipboard restrictions for Privileged Remote Access risk quantification.
Adds File Upload Inspection for Privileged Console factor to quantify compromise risk in PRA Adds File Upload Inspection for Privileged Portal factor to quantify compromise risk in PRA Adds Restricting File Download & Clipboard Copy factor to quantify compromise risk in PRA
3 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-05-04
May 4, 2026
· release notes
Zscaler Workflow Automation adds CSV export for Incidents and SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. integration via ServiceNow.
Adds CSV export capability on the Incidents page to download displayed incidents. Enables SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) integration in Workflow Automation with support for ServiceNow ticketing.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-04
May 4, 2026
· release notes
Private Access adds automated Manager software update capability for App and Network Connectors with new UI status columns.
Adds automated Manager software updates for App Connector and Network Connector when running version 25.46.3 or later Adds Version Profile column to the connector details table to display the applied version profile
2 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-05-01
May 1, 2026
· release notes
AI Guard 2.15.1 adds custom RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles and Azure Data Explorer log export via Event Hub.
Adds support for custom roles and granular permissions in Role-Based Access Control Role-Based Access Control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC), replacing the fixed Administrator, Editor, and Viewer model Enables streaming event metadata and content to Azure Data Explorer (ADX) via Azure Event Hub for advanced analytics and long-term storage
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-05-01
May 1, 2026
· release notes
ZPA adds client hostname to VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Connected Users and automated RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 OS update status UI for connectors
Adds hostname column to the VPN Connected Users page on private.zscaler.com and zpatwo.net Adds OS Update Filter dropdown and OS Update status field with hover details in App Connector, Private Service Edge, Private Cloud Controller, and Network Connector detail views Adds Last OS update time and OS updates enabled indicator to connector detail views for prebuilt RHEL 9.x images
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-05-01
May 1, 2026
· release notes
ZIA adds Gen AI prompt configuration for QuillBot/Google AI and expanded Google Workspace SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls
Adds enableQuillbotAIPrompt and enableGoogleAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings API for Gen AI prompt support. Adds promptCaptureEnabled Boolean field to the WebApplicationRule model in /webApplicationRules API to control prompt capture for generative AI apps. Adds Capture Prompts option to Cloud App Control policy UI (Policies > Access Control > Internet & SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. > Policies > Cloud App Control Policy > Add > AI & ML Applications). Expands SSPM coverage with 24 new controls for Google Workspace. Adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support for new PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries: Argentina Uniform Bank Code, Cambodian National ID, Mexico BRFC, IRFC, and NSS.
+1 more
show less
Adds collaboration scope (External, Internal, Any) configuration for Microsoft Teams DLP rules.
6 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-04-30
Apr 30, 2026
· release notes
UVM adds an Overview dashboard with MTTR metrics and granular ticket workflow controls including rule enable/disable and default status.
Adds the Overview Dashboard for consolidated viewing of findings from ingestion to remediation, featuring risk-adjusted severity breakdowns and Mean Time to Remediate (MTTR) metrics Enables saving individual Ticket Workflow rules in an active or inactive state without deleting configuration Allows defining a default status for all new tickets that do not match specific workflow rule criteria Introduces an automatic ticket closure rule with the ability to exclude specific statuses from auto-closure logic
4 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-04-29
Apr 29, 2026
· release notes
Release 2026-04-29 introduces UI capabilities for organizing dashboards and reports via tags.
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-04-29
Apr 29, 2026
· release notes
Adds tag-based filtering for dashboards and reports in the Agentic Security Operations Platform.
Adds the ability to create and assign tags to dashboards and reports for easier filtering and locating.
1 detail in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-04-27
Apr 27, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. introduces DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine selection for classification, bulk CSV unmanaged DB registration, Azure AI/Cosmos policies, and Experience Center migration
Adds ability to select specific DLP engines in Data Classification Settings page to control which engines are used for alerting purposes Adds CSV-based bulk registration capability for unmanaged database servers via CSV templates in Resource Inventory Enables test connectivity checks for registered services (unmanaged databases, Snowflake, Databricks) before initiating a scan Adds 18 new data posture policies for Azure AI Foundry and Azure Cosmos DB within Data Posture Policies section Migrates DSPM management interface to Zscaler Experience Center in Zscaler Admin Console
+2 more
show less
Restricts cloud account onboarding network configuration to custom VNets/VPCs VPCs Virtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. , removing default Zscaler-managed resources Enforces use of only on-premises scanners for on-premises database scans
7 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-04-24
Apr 24, 2026
· release notes
Codex app support, GitHub Copilot provider, AWS tenant settings in AI Guard 2.14.2
Adds Codex application support with request and response blocking capabilities Adds GitHub Copilot as a supported provider for prompt visibility and blocking Allows viewing AWS Account ID in the Tenant Settings General tab for optional AWS integrations Enables starting a manual sync with ZIA from the Tenant Settings Integrations tab outside scheduled windows Adds M365 response blocking support and hides default suggestions for that use case
+2 more
show less
Ensures consistent responses in Copilot Think Deeper Mode and enforces custom block messaging for ChatGPT Displays policy changes as entries on the Audit Log page
7 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-04-23
Apr 23, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI/CosmosDB policies, Experience Center migration, CSV bulk DB registration, RDBMS sampling, and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine selection
Adds new data posture policies for Azure AI Foundry, Azure OpenAI, and Azure Cosmos NoSQL (17 policy titles) to detect sensitive data exposure and misconfigurations DSPM is now available in Experience Center, accessible via the Zscaler Admin Console for Experience Center Adds CSV templates for bulk registration of unmanaged database servers in Resource Inventory Enables selecting specific DLP engines in Data Classification Settings for sensitive data identification and alerting Introduces predefined RDBMS random-row sampling scans to reduce scan times and impact on large databases
+3 more
show less
Provides 70 predefined data classification engines for common sensitive data types (e.g., credit cards, SSNs) to reduce false positives Adds On-Premises filter to the Clouds filter on the Data Duplication page Adds Test Connectivity feature for registered services (unmanaged databases, Snowflake, Databricks) in Resource Inventory
8 details in Everything
└──▷ BREAKING ON UPGRADE
! The default network configuration using Zscaler-managed resources is removed for cloud account onboarding; custom network configuration (VNets/VPCs VPCs Virtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. ) is now required.! DSPM no longer provides support for using cloud scanners to scan on-premises databases; only on-premises scanners are supported.! The Data Sensitivity Settings page is renamed to Data Classification Settings.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-04-22
Apr 22, 2026
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds on-premises scanner enforcement, Experience Center access, bulk unmanaged DB registration, and RDBMS sampling.
Adds ability to bulk register unmanaged database servers via CSV templates in the Resource Inventory Enforces use of only on-premises scanners for scanning on-premises databases, removing cloud scanner support Makes DSPM accessible within the centralized Zscaler Experience Center platform Adds configurable DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine selection for data classification and alerting in Data Classification Settings Supports random-row sampling for RDBMS data scans to improve accuracy and reduce scan times
+3 more
show less
Adds On-Premises filter to Clouds in the Data Duplications page Enables clicking file paths and copy counts in Data Duplications for quick detail navigation Adds Test Connectivity feature for registered services like unmanaged databases, Snowflake, and Databricks
8 details in Everything
└──▷ BREAKING ON UPGRADE
! The default network configuration using Zscaler-managed resources for cloud account onboarding is removed; only custom network configuration (creating VNets or VPCs VPCs Virtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules. ) is supported.! Support for using cloud scanners to scan on-premises databases is removed; only on-premises scanners are now allowed.! The Data Sensitivity Settings page is renamed to Data Classification Settings .
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-21
Apr 21, 2026
· release notes
Private Access now supports two tenants per Authentication Service instance via the Admin Console.
Adds support for two Private Access (ZPA) tenants with a single Authentication Service tenant.
1 detail in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-04-21
Apr 21, 2026
· release notes
Authentication Service now supports integrating two Private Access tenants for multi-tenant SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. and access management
Adds support for integrating two Private Access (ZPA) tenants simultaneously through the Zscaler Admin Console Enables IdP-initiated IdP-initiated A SAML or OIDC login flow where the identity provider starts the session and pushes an assertion to the service provider without the user first requesting access, removing the SP-side redirect step. and service provider-initiated single-sign-on (SSO) to access all configured private tenants from Authentication Service Supports Zscaler Client Connector enrollment and browser-based access for multiple Private Access tenants
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-20
Apr 20, 2026
· release notes
ZIA adds predefined DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for Argentina and Mexico PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. ; Microsoft Teams DLP supports collaboration scope filtering
Adds Argentina Uniform Bank Code (CBU) to the set of predefined DLP dictionaries Adds Cambodian National ID (KIdC) to the set of predefined DLP dictionaries Adds Mexico Business Tax ID (BRFC) to the set of predefined DLP dictionaries Adds Mexico Individual Tax ID (IRFC) to the set of predefined DLP dictionaries Adds Mexico Social Security Number (NSS) to the set of predefined DLP dictionaries
+1 more
show less
Enables defining Microsoft Teams DLP rules with a new collaboration scope option: External, Internal, or Any
6 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-04-20
Apr 20, 2026
· release notes
Mapping Copilot introduces AI-guided mapping assistant for data sources in the SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Platform.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-17
Apr 17, 2026
· release notes
ZIA adds Slack DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident forwarding, Adaptive Access and Alerting APIs, Azure integration endpoints, NSSE feeds, NTP CLI, Sandbox rules, and O365 policy options.
Adds GET /adaptiveAccessProfiles and GET /adaptiveAccessProfiles/profiles/rules API endpoints to retrieve Adaptive Access profiles and their rules on zia, zscalerone, zscalertwo, zscalerthree, and zscloud platforms. Adds POST /alertRuleConfiguration/webhooks/test endpoint to test webhook configurations alongside existing CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints for alert definitions (/alertDefinitions), Security alert rules (/alertRuleConfiguration/rules), UEBA alert rules (/alertRuleConfiguration/uebaRules), and webhooks (/alertRuleConfiguration/webhooks). Adds GET /azure/refreshConnectionStatus, POST azure/refreshConnectionStatus, GET /azure/tunnelConfiguration, POST /azure/tunnelConfiguration, DELETE /azure/unConfigureTunnel/{hubId}, GET /azure/unConfigureTunnelStatus, GET /azure/virtualHubs, and POST azure/virtualHubSync API endpoints for Azure VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. and tunnel management. Adds urlCategoriesExclude, urlClassesExclude, and urlSuperCategoriesExclude fields to the ZmanageNssFeed model in the /nssFeeds APIs to exclude specific URL classes, categories, and super categories from NSS logs. Adds %s{ac_doc_subtypes} field to the Feed Output Format for NSS or Cloud NSS feeds configured for Email DLP logs to capture document subtypes like invoices and expense reports.
+10 more
show less
Extends DLP rule name reporting by adding DLP Rule Name as a Data Type in Interactive Reports widgets and Web Insights, allowing users to schedule incident reports filtered by rule name. Enables forwarding of Slack chat-based DLP policy incidents to Zscaler Incident Response, Workflow Automation, Web Insights, Logs, and the DLP policy auditor, in addition to existing file-based violations. Adds Evaluate Other Policies and Bypass Other Policies options under the Do Not Inspect action for the O365 One Click predefined rule in SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS Inspection Policy. Adds Sandbox_Docs_Trusted, Sandbox_Docs_Archives, and Sandbox_Exes_Web default rules for Advanced Sandbox, which are disabled by default but can be enabled; these cover Microsoft Office/PDF, Archives, and Executables/Web Content with specific first-time and subsequent download actions. Adds support for identifying Kafka (Application Service) and Zalo (Instant Messaging) as new Network Applications in Firewall Control. Allows configuring a separate Cloud NSS feed specifically for alerts to monitor data lag, loss, and SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. connection health. Adds Instance Discovery Report support for Microsoft Azure with discovery levels at Domain, Tenant, and Resource. Extends cloud application instances creation to Google Gemini and Microsoft Copilot. Adds ability to add or remove custom NTP servers via CLI on zscalertwo.net and zscalerthree.net Virtual Service Edge appliances. Adds Authentication Service Authentication and Authentication Service SCIM as new log types for NSS for Web, and Authentication Service Admin Audit Log as a new application filter for Admin Audit Logs.
15 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-04-16
Apr 16, 2026
· release notes
Incident details page now supports in-place actions and status refresh; quarantined email release status tracking improved; statement predicate limit raised to 100.
Incident Details page allows performing actions directly without navigating away Quarantined Email Status field added for released emails with a View Status link
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-16
Apr 16, 2026
· release notes
Private Access adds Tag Management for application segments and policies with namespaces and tag groups.
Adds Tag Management capability to create, organize, and manage tags for classifying and grouping resources in Private Access Introduces namespace configuration to logically organize tags and avoid naming conflicts within defined application segments Allows assignment of tag groups and tag values to access policies to simplify policy configuration
3 details in Everything
Risk360 — Release Upgrade Summary (2026) — 2026-04-15
Apr 15, 2026
· release notes
Risk360 now supports HECVAT compliance for risk assessment
Adds HECVAT Risk Framework support to the Risk360 service
1 detail in Everything
Internet & SaaS (ZIA) — Zscaler Endpoint DLP Release Summary (2026) — 2026-04-15
Apr 15, 2026
· release notes
ZIA Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. on macOS (26.2.0.1416) adds network type enforcement, CIDR CIDR A notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. /regex for shares, EDM, share-externally, cancel action, and Base64 inspection.
Network Type selector (Trusted , Off-Trusted , VPNVPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. ) in Endpoint DLP policy rules for Network Share, Printing, and Device Control channelsCIDR ranges and regular expressions for advanced matching when creating/editing network shares in DLP resourcesExact Data Matching (EDM) page at Analytics > Endpoint Data Scan > Sensitive Information for structured sensitive data protection Share Files Externally capability with secure HTML encryption, accessed via Analytics > Endpoint Data Scan > Sensitive InformationEnd-user ability to cancel triggering activity for Removable Storage, Network Share, or Personal Cloud Storage policy rules on macOS
+1 more
show less
Inspection of Base64-encoded content for sensitive data in DLP policy rules
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-15
Apr 15, 2026
· release notes
ZIA adds Microsoft Teams collaboration scope filtering, new regional DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries, and Smartsheet integration in Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. .
Adds External , Internal , or Any collaboration scope options when creating DLP rules for Microsoft Teams to scan messages and attachments based on channel membership.
1 detail in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-04-14
Apr 14, 2026
· release notes
Adds Google Cloud Storage as an outegration for report delivery in Asset Exposure Management.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-13
Apr 13, 2026
· release notes
ZIA adds Gen AI prompt configuration for QuillBot and Google AI via API
Adds enableQuillbotAIPrompt and enableGoogleAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings APIs.
1 detail in Everything
Zero Trust Branch — Release Upgrade Summary (2026) — 2026-04-13
Apr 13, 2026
· release notes
Zero Trust Branch 8.0.8P4 adds DDNS forwarding, DNS Proxy toggle, and App Connector auto-recovery status.
Enables DNS Proxy to forward Windows DDNS update packets to private DNS servers, including TSIG TSIG A DNS authentication mechanism defined in RFC 2845 that uses shared secret keys and HMAC to sign DNS messages, letting resolvers and servers verify that updates or zone transfers come from a trusted peer. updates over TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 53 Adds a UI control to enable or disable the DNS Proxy Service for a specific site Displays a new status for invalid hardware IDs on the App Connector page and shows Re-provisioning App Connector during auto-recovery
3 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-04-10
Apr 10, 2026
· release notes
Client Connector Portal 4.5.3 adds macOS device posture visibility, Export option to Failed Posture Devices, and dashboard support for Authentication Service tenants.
Enhances the Device Posture dashboard to display macOS devices in addition to Windows devices
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! Removes the options to soft remove a device or view device fingerprint details from the Failed Posture Devices page
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-04-10
Apr 10, 2026
· release notes
AI Guard 2.13.1 adds default LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider auto-provisioning and ElevenLabs TTS support.
New auto-provisioning behavior for default LLM providers during AI Guard tenant creation New integration with ElevenLabs (text-to-speech mode) as a supported provider
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-10
Apr 10, 2026
· release notes
ZIA adds sandbox default rules, NTP CLI, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. logs, and workload group deletion API
Adds three new disabled-by-default Advanced Sandbox rules (Sandbox_Docs_Trusted, Sandbox_Docs_Archives, Sandbox_Exes_Web) for Microsoft Office, PDF, Archives, Executables, and Web Content. Enables adding or removing custom NTP servers from configuration files via CLI commands on Virtual Service Edge. Adds DLP Rule Name as a schedulable data type in Interactive Reports widgets and Web Insights for ZIA. Extends Email DLP Insights Logs with a Subdocument Type column and filter, capturing around 200 new document types across 10 categories. Adds the %s{ac_doc_subtypes} field to NSS Feed Output Formats for Email DLP logs.
+8 more
show less
Allows configuring Evaluate or Bypass other policies actions in the Predefined O365 One Click rule within SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS Inspection Policy. Adds URL classes, categories, and super categories include/exclude filters to NSS and Cloud NSS feeds for web logs. Adds urlCategoriesExclude, urlClassesExclude, and urlSuperCategoriesExclude fields to the ZmanageNssFeed model in the /nssFeeds APIs. Extends network application identification support to Kafka (Application Service) and Zalo (Instant Messaging) in Firewall Control. Enables configuration of a separate Cloud NSS feed specifically for alerts to monitor data lag, loss, and SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. connectivity. Adds apiSessionTimeout field to the AdvancedSettings model in the /advancedSettings APIs on zscalertwo.net and zscalerthree.net. Adds subdocument type support and a Subcategory column to the Data Discovery Report with an interactive bubble chart. Enables bulk deletion of workload groups via the DELETE /workloadGroups endpoint.
13 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-09
Apr 9, 2026
· release notes
ZPA Microsegmentation adds Anti-Tamper, AKS AKS Azure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. /GKE GKE Google Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. support, and SLES 15 agent compatibility
Anti-tamper protection for the Microsegmentation Agent ensures that reporting, enforcement, and upgrade processes cannot be maliciously disabled or altered, even by actors with admin privileges. Microsegmentation extends support to Azure Kubernetes Service (AKS) and Google Kubernetes Engine (GKE), enabling visibility into Kubernetes inventory and flow logs via the agent. Microsegmentation agent can now be installed on Suse Linux Enterprise Server 15.
3 details in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-04-09
Apr 9, 2026
· release notes
Zscaler Authentication Service now supports end user identity management with Adaptive Access Engine integration.
Authentication Service now provides support for end users in new deployments, allowing admins to manage a single identity across all Zscaler services. End user support enables adaptive access use cases through the Adaptive Access Engine and Step-Up Authentication.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-08
Apr 8, 2026
· release notes
ZIA adds five new predefined DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. detection in Argentina, Cambodia, and Mexico.
Adds predefined DLP dictionary Argentina Uniform Bank Code to detect leakage of CBU Adds predefined DLP dictionary Cambodian National ID to detect leakage of Khmer Identification Code (KIdC) Adds predefined DLP dictionary Mexico Business Tax ID to detect leakage of BRFC Adds predefined DLP dictionary Mexico Individual Tax ID to detect leakage of IRFC Adds predefined DLP dictionary Mexico Social Security Number to detect leakage of NSS
5 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-04-03
Apr 3, 2026
· release notes
Zscaler Client Connector 4.5.3 adds macOS posture support and Export on Failed Posture Devices page
Enhances the Device Posture dashboard to display macOS devices in addition to Windows devices Supports the Device Posture dashboard for Authentication Service tenants
2 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the options to soft remove a device or view device fingerprint details from the Failed Posture Devices page
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-03
Apr 3, 2026
· release notes
ZIA adds API session timeout config, bulk workload group deletion API, NTP CLI management, and new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /reporting fields
Adds apiSessionTimeout field to the AdvancedSettings model in the /advancedSettings API to control API session inactivity timeout (5-20 minutes). Adds DELETE /workloadGroups endpoint to delete multiple workload groups for an organization. Adds CLI commands to add or remove custom NTP servers from configuration files on Virtual Service Edge. Enables selection of Evaluate Other Policies or Bypass Other Policies actions in the O365 One Click predefined rule within SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS Inspection Policy. Adds Subcategory column and new Subdocument Type filter/column to Email DLP Insights Logs for document classification visibility.
+5 more
show less
Adds %s{ac_doc_subtypes} field to NSS Feed Output Format for Email DLP logs. Adds urlCategoriesExclude, urlClassesExclude, and urlSuperCategoriesExclude fields to the ZmanageNssFeed model in the /nssFeeds API for URL exclusion in web logs. Adds support for Cloud NSS feeds specifically for alerts monitoring. Adds default disabled rules Sandbox_Docs_Trusted, Sandbox_Docs_Archives, and Sandbox_Exes_Web for Advanced Sandbox subscriptions. Adds identification and management support for Kafka and Zalo as new network applications in Firewall Control.
10 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-02
Apr 2, 2026
· release notes
ZPA adds Secondary DNS support in Network Segments and new VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. diagnostics/logs
Adds secondary_dns_server configuration option to Network Segments for FQDN-based application access backup Enables new VPN traffic flow logs for troubleshooting legacy app connectivity issues Enables new VPN user logs for analyzing access and authentication diagnostics
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-04-02
Apr 2, 2026
· release notes
New Browser Extension for Zero Trust Browser adds BDR and browser-native DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. capabilities across ZIA clouds.
Browser Extension for Zero Trust Browser enables browser detection and response (BDR) and browser-native data loss prevention (DLP) capabilities. Posture-based application access is now available through the new browser extension. The Browser Extension for Zero Trust Browser provides seamless enterprise access from any existing browser.
3 details in Everything
Private Access (ZPA) — App Connector Release Summary (2026) — 2026-04-02
Apr 2, 2026
· release notes
New Private Cluster Manager (PCM) service for large-scale App Connector configuration management
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-04-01
Apr 1, 2026
· release notes
ZPA adds Client Connector Trusted Network as a timeout policy criteria
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-31
Mar 31, 2026
· release notes
ZPA adds support for configuring private link domain patterns to route traffic correctly.
Client Connector — Client Connector App Release Summary (2026) — 2026-03-31
Mar 31, 2026
· release notes
Client Connector 4.9 adds secondary DNS for Legacy VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. , PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parser override, post-upgrade CLI params, and specific software version posture checks.
Adds V8 JavaScript based PAC Parser as the mandatory parser regardless of app profile settings, deprecating the Legacy (SpiderMonkey-based) PAC parser Adds support for using a secondary DNS server as a backup in network segments configured for VPN (for Legacy Apps) Adds the ability to update some installation parameters using the CLI without having to reinstall Zscaler Client Connector Adds checking for specific software versions for device postures: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender Adds support for registry keys with the REG_BINARY type with the Registry Key device posture profile
+1 more
show less
Adds Zscaler Deception service entitlement support for Authentication Service tenants
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-31
Mar 31, 2026
· release notes
ZIA adds WPAD protocol support in Advanced Threat Protection to allow external proxy auto-discovery.
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-03-30
Mar 30, 2026
· release notes
Zscaler UVM integrates External Attack Surface Management (EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. ) for native asset inventory and vulnerability scanning of internet-facing assets.
Adds integrated External Attack Surface Management (EASM) capabilities to the Zscaler SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. platform, enabling automated discovery and scanning of internet-exposed assets starting from admin-configured seeds.
1 detail in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-03-30
Mar 30, 2026
· release notes
AEM integrates native EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. capabilities for automated discovery and scanning of internet-facing assets.
Adds app.avalor.io integrated External Attack Surface Management (EASM) capabilities to the Zscaler Security Operations (SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. ) platform.
1 detail in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-03-27
Mar 27, 2026
· release notes
Client Connector Portal 4.5.3 adds macOS posture visibility, export capabilities, and Authentication Service tenant support
Adds macOS device display to the Device Posture dashboard alongside Windows devices Adds an Export option to the Failed Posture Devices page Enables the Device Posture dashboard for Authentication Service tenants
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the option to soft remove a device from the Failed Posture Devices page! Removes the option to view device fingerprint details from the Failed Posture Devices page
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-03-27
Mar 27, 2026
· release notes
New IP Detector, PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. disable actions, prompt action filtering, and six new AI providers in AI Guard 2.12.0
Adds IP Detector to analyze user input against context for semantic similarity indicating potential leak, paraphrase, or direct exposure. Adds the Disable policy action option for PII detectors, allowing specific labels (defaulted to Person's name ) to be excluded from detection. Adds filtering by prompt action in Log Exports with options Export Allowed/Detected Prompts and Export Blocked Prompts . Adds support for six new AI providers: Napkin AI, DeepAI, Google Gemini Enterprise, OpenCode, Gamma, and Builder.io.
4 details in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-03-27
Mar 27, 2026
· release notes
Adds NSS integration to stream Authentication Service logs to external SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point.
Enables streaming of authentication service logs (admin audit, auth, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. ) to Nanolog Streaming Service (NSS) and Cloud NSS for external SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-27
Mar 27, 2026
· release notes
ZIA adds API session timeout control, DELETE /workloadGroups endpoint, and auth audit log support.
Adds apiSessionTimeout field to the AdvancedSettings model on /advancedSettings APIs to configure API session inactivity limits (5-20 minutes) Adds DELETE /workloadGroups endpoint to delete multiple workload groups for an organization Adds new NSS log types Authentication Service Authentication and Authentication Service SCIM for web feeds
3 details in Everything
Risk360 — Release Upgrade Summary (2026) — 2026-03-26
Mar 26, 2026
· release notes
Service update introducing HITRUST HITRUST A US-based certification framework for healthcare data security, maintained by the HITRUST Alliance, that maps controls from HIPAA, NIST, and ISO into a single assessable standard tools can target to prove compliance. framework support for risk assessment workflows.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-26
Mar 26, 2026
· release notes
ZPA Events Diagnostics adds App Connector details to Provisioning Key Not Found logs
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-03-26
Mar 26, 2026
· release notes
Zscaler Cloud & Branch Connector platform updates to AMI version ZS42.1.0 and GCP VM zs-cc-ga-03092026 with new defaults.
Updates the Zscaler Cloud Connector Amazon Machine Image (AMI) version to ZS42.1.0 on cloud platforms connector.zscaler.net, connector.zscalertwo.net, connector.zscalerthree.net, and connector.zscloud.net Updates the Zscaler Cloud Connector Google Cloud Platform Virtual Machine image version to zs-cc-ga-03092026 on cloud platforms connector.zscaler.net, connector.zscalertwo.net, connector.zscalerthree.net, and connector.zscloud.net Updates the GCP Terraform scripts (v0.3.1) to default to the new Google Cloud Marketplace image zs-cc-ga-03092026 Updates the Zscaler Cloud Connector Microsoft Azure Virtual Machine image version to 42.1.0 on cloud platforms connector.zscaler.net, connector.zscalertwo.net, connector.zscalerthree.net, and connector.zscloud.net
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-25
Mar 25, 2026
· release notes
Events Diagnostics raw logs now include App Connector modification details for Provisioning Key Not Found events
Deception — Release Upgrade Summary (2026) — 2026-03-24
Mar 24, 2026
· release notes
Zscaler Deception adds macOS landmine features, Firefox browser lures on Linux, Python handlers for CVE datasets, and new Oracle/SolarWinds coverage.
Adds Brute Force Detection , File Decoys , Defense Evasion , and Triage features for macOS-based endpoints via Landmine Agents Adds support for browser lures in Firefox browsers on Linux endpoints via Landmine Agents and Agentless installations Introduces Python-based handlers for Vulnerable Application Datasets to replace YAML-based definitions, enabling multi-step exploit simulations and dynamic response handling
3 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-03-23
Mar 23, 2026
· release notes
Workflow Automation adds Response Available widget, finer-grained policy exception durations, standalone Incident Summary, Digest Type filtering, and type-specific merge tags
Adds a Response Available widget to the Incidents page and Incident Analytics dashboard to display counts of incidents with user or manager responses. Enables manual creation of policy exceptions on the Incident Details page with duration specified in days, hours, and minutes (previously minutes only). Makes the Incident Summary page a standalone view accessible via a link from the main Incidents page, opening in a new tab. Adds a Digest Type field to the Notification Templates page to separate configuration for end user/admin digest templates versus user/escalation notification templates. Restricts available merge tags on notification templates based on the selected Digest Type , showing distinct sets for digest vs. escalation/user notifications.
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Editing existing notification templates configured with merge tags no longer supported for that specific notification type will now show an error message.
Client Connector — Client Connector App Release Summary (2026) — 2026-03-23
Mar 23, 2026
· release notes
iOS 4.5 adds Auth Service integration, custom Strict Enforcement notifications, and MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. captive portal control.
Enables disableCaptivePortalNotification in the MDM VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. configuration to disable captive portal prompts Adds custom notification capability for users blocked by Strict Enforcement mode Integrates Authentication Service for OTPs, device group-based app profiles, posture-based entitlements, quarantine, and force-removal
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-20
Mar 20, 2026
· release notes
ZIA adds APIs for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. settings, HTTP header profiles, root/intermediate certificates; introduces Microsoft Copilot Readiness Assessment dashboard and NSS feed fields
Adds GET /webDlpGlobalOptions and PUT /webDlpGlobalOptions endpoints to retrieve and update DLP Advanced Settings
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-19
Mar 19, 2026
· release notes
Updated ZPA Network Connector Azure image prepared for upcoming OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment support
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-03-18
Mar 18, 2026
· release notes
Adds PDF export to AI Guard Dashboard/Insights, masking config flags, and new User mode AI providers.
Adds send_masked_pii PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. flag on Product with Enable /Disable behavior for controlling whether masked content is sent to LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers Adds PDF format export option from the Dashboard and Insights pages in the UI Supports MaxAI (api.maxai.me), Lovable (api.lovable.dev), Bolt (bolt.new), and Google Gemini Code (*.gemini.google.com, cloudcode-pa.googleapis.com) as User mode providers
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-18
Mar 18, 2026
· release notes
ZIA adds Workday RaaS API support, Microsoft Teams DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. quarantine tombstones, and public cloud Custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. with dynamic validation
Workday tenant configuration now supports RaaS-based API Access for secure programmatic data retrieval and management.SaaS Security Data at Rest DLP Policy adds a new option to quarantine sensitive content in Microsoft Teams , including a configurable tombstone message for end users.Custom IPS is now supported on Zscaler's public cloud (zscalertwo.net and zscalerthree.net) without requiring Private Service Edge infrastructure, with a rule limit increased to 1,000.Custom IPS adds dynamic validation for signature rules, accessible via the new Save & Promote button in Add/Edit Signature Rule windows and the Promote All button on the Custom Signature Rules page.Custom IPS extended support includes inspection of decrypted web traffic (via SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection) and HTTP protocol-aware signatures with HTTP-specific options.
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-17
Mar 17, 2026
· release notes
ZIA adds Quarantine action for Outbound Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and Grammarly Gen AI prompt support via API/config
Adds enableGrammarlyPrompt Boolean field to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API, enabling generative AI prompts for Grammarly. Adds a Quarantine action option in the UI under Policy > Email DLP for Outbound Email DLP policies targeting Microsoft Exchange.
2 details in Everything
Zero Trust Branch — Release Upgrade Summary (2026) — 2026-03-17
Mar 17, 2026
· release notes
Zero Trust Branch 8.0.8P3a adds switchover thresholds, WAN prioritization for IPSec tunnels, and PBR for system traffic.
Adds a configurable Switchover Threshold to routing policies to control WAN failover sensitivity in both Best and Balanced traffic distribution modes. Enables defining a preferred order of WAN interfaces for establishing IPSec tunnels to ZIA or site-to-site, prioritizing link quality/cost while maintaining automatic failover. Adds an Apply for locally generated traffic option in the PBR rule configuration to route appliance-originated system traffic (e.g., DHCP relay packets) to a specified nexthop interface.
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-03-16
Mar 16, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds M365 tenant onboarding, GCP data classification evidence, NetApp SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. /NFS scanning, column-level DB scans, and OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for embedded images
Adds support for on-premises NetApp file shares using NFS and SMB protocols for discovery and classification. Adds column-level sensitive data scanning for databases with visibility in the Data Tab and Column-Specific Evidence Tab. Adds Optical Character Recognition (OCR) scanning to identify sensitive data in images embedded in PDF, Word, and PPT files. Adds Microsoft 365 tenant onboarding to monitor data stores, access MIP labels, and integrate with Microsoft Copilot. Adds GCP as a supported platform for Data Classification Evidence generation for scanned files and tables.
+4 more
show less
Adds detailed error messages for failed on-premises file server discovery to diagnose networking or authentication issues. Extends MIP labeling to on-premises SMB and NFS file shares with automatic sensitivity label application via action rules. Adds a File Activity Tab to view MIP labeling actions, entities, and timestamps. Introduces new data posture policies for AWS Databricks, Azure OpenAI, Azure AI Foundry, Azure Cosmos DB, GCP Vertex AI, and GCP BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. .
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-16
Mar 16, 2026
· release notes
ZIA adds Lucidchart and Zendesk support in Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. and RPM file type detection
Adds Lucidchart as a supported platform for onboarding via the 3rd-Party App Governance Admin Portal in Advanced SSPM Adds Zendesk as an API-based platform for onboarding via the 3rd-Party App Governance Admin Portal in Advanced SSPM Extends File Type Control and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies to detect and inspect RPM files in the Archive category
3 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-03-13
Mar 13, 2026
· release notes
Zscaler Client Connector Portal 4.5.2 adds custom logo/theme assignment and extends unattended mode password expiry to 90 days.
Adds the ability to upload company logos for display in the app, pop-up notifications, and Windows App Profile theming Extends the maximum expiration time for uninstall, upgrade, or revert passwords used in unattended mode from 48 hours to 90 days
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-03-13
Mar 13, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds GCP data classification evidence, on-prem NetApp support, column-level DB scanning, M365 tenant onboarding, and new posture policies for AWS/Azure/GCP.
Adds Data Classification Evidence in GCP, generating evidence data for scanned files and tables to allow in-context investigation of sensitive data Adds Summary View and Full View options to the export feature on the Data Duplications page to report duplicate file locations and attributes Introduces new AWS, Azure, and GCP Data Posture Policies covering Databricks, MongoDB, OpenAI, Cosmos DB, Vertex AI, and BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. configurations with sensitive data Adds support for discovering and classifying sensitive data in on-premises NetApp file shares using NFS and SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. protocols Adds column-level scanning for databases, enabling visibility into specific columns containing sensitive data with associated DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries
+4 more
show less
Adds OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. scan capability to identify sensitive data in images embedded within PDF, Word, and PPT files Provides detailed discovery status and error messages (networking, authentication, permission issues) for on-premises file servers that fail scanning Adds support for onboarding Microsoft 365 (M365) tenants to monitor data stores and access MIP labels or integrate with Copilot Adds MIP labeling for on-premises SMB and NFS file shares via action rules, and a new File Activity tab to view MIP labeling events
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-13
Mar 13, 2026
· release notes
ZIA adds HTTP NSS feeds, Copilot readiness assessment, Grammarly Gen AI prompts, and bandwidth latency fields.
%s{doc_subtype} and %s{upload_doc_subtype} fields added to NSS Feed Output Format for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. classificationHTTP feed support for Nanolog Streaming Service (NSS) with a new copy action in Admin Console Web Insights Logs gain Request Latency Due to Bandwidth Control (ms), Response Latency Due to Bandwidth Control (ms), and Total Latency Due to Bandwidth Control (ms) columns/filters %d{txn_delay_req} and %d{txn_delay_resp} fields added to NSS Web Logs Feed Output FormatenableGrammarlyPrompt Boolean field available in AdvancedUrlFilteringCloudAppOptions model at /advancedUrlFilterAndCloudAppSettings API
+2 more
show less
SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Workflows includes new Microsoft Copilot Readiness Assessment page accessible via Analytics menu%s{labelname}, %s{accessibility_flags}, and %s{copilot_accessible} fields added to SaaS Security NSS/Cloud NSS Feed Output Format
7 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-03-13
Mar 13, 2026
· release notes
New Azure partner integration API endpoints and increased subscription limits for Cloud & Branch Connector
Adds programmatic management of Azure accounts and groups via new REST endpoints including GET /publicCloudTenant, POST /publicCloudTenant, PUT /discoveryService/azure/subscriptionSync, and others for CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations on Azure tenant and subscription data. Increases the maximum number of subscriptions per Cloud Connector Azure partner integration account from 32 to 128.
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-03-12
Mar 12, 2026
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds M365 tenant onboarding, GCP evidence data, NetApp discovery, and column-level DB scanning.
Adds Microsoft 365 (M365) tenant onboarding to monitor and scan data stores, access MIP labels, and integrate with Copilot Enables Data Classification Evidence in GCP for in-context investigation and validation of sensitive files and tables Expands On-Premises NetApp File Shares support using NFS and SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. protocols for discovery and classification Introduces Column-Level Scanning for databases to map sensitive data types to specific columns with evidence details Adds OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. Scan capability for sensitive data in images embedded in PDF, Word, and PPT files
+1 more
show less
Provides MIP Labeling for On-Premises File Shares (SMB/NFS) via action rules to auto-apply sensitivity labels
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-11
Mar 11, 2026
· release notes
ZIA adds Cloud Custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. on public cloud with dynamic validation and 1000 rule limit; Teams DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. quarantine
Enables Custom IPS signature rules directly on Zscaler's public cloud without Private Service Edge infrastructure, raising the limit to 1,000 rules (previously 500). Adds dynamic validation for Custom IPS signature rules via new UI actions: Save & Promote button in rule editor and Promote All button on the rules list page. Extends DLP policy quarantine capability to sensitive content in Microsoft Teams, allowing admins to specify a tombstone message and remove quarantined items via the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report.
3 details in Everything
Cloud & Branch Connector — Zscaler Client Connector for VDI Release Summary (2026) — 2026-03-11
Mar 11, 2026
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. 1.7 adds a global VIP VIP A Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. to mandatory TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. bypass rules.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-09
Mar 9, 2026
· release notes
Application Type Classification column added to App/User Group Relationships usage reports in ZPA UI and CSV exports.
Adds an Application Types column to the Application and User Group Relationships Usage page on private.zscaler.com and zpatwo.net Includes Application Types data in CSV files downloaded from the Application and User Group Relationships Usage page
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-09
Mar 9, 2026
· release notes
ZIA adds RPM file support to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and File Type Control policies for Archive category.
Client Connector — Release Upgrade Summary (2026) — 2026-03-06
Mar 6, 2026
· release notes
Zscaler Client Connector 4.5.2 adds logo upload and theme assignment, extends unattended password expiry
Adds the ability to upload company logos to display on the app and in pop-up notifications. Allows assigning a customized theme to a Windows app profile. Extends the maximum time allowed before an uninstall, upgrade, or revert password used in unattended mode expires from 48 hours to 90 days.
3 details in Everything
Internet & SaaS (ZIA) — Zscaler Endpoint DLP Release Summary (2026) — 2026-03-06
Mar 6, 2026
· release notes
ZIA Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. 26.02.0.21 adds network type enforcement, CIDR CIDR A notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. /regex matching, EDM support, and Base64 inspection.
Adds network type filtering (Trusted, Off-Trusted, VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. ) to Network Share, Printing, and Device Control policy rules Adds Classless Inter-Domain Routing Classless Inter-Domain Routing A notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. (CIDR) ranges and regular expressions for matching in Network Share resources Adds Exact Data Matching (EDM) page at Analytics > Endpoint Data Scan > Sensitive Information for structured data protection Adds Share Files Externally capability to encrypt sensitive files into secure HTML format, accessed via Analytics > Endpoint Data Scan > Sensitive Information Adds enhanced blocking of unauthorized file save operations on removable storage or network shares within Microsoft Office applications
+2 more
show less
Adds ability to completely exclude specific printers from Endpoint DDP and Device Control inspection by selecting disabled in Exception Settings for Printers Adds inspection of Base64-encoded content for sensitive data
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-06
Mar 6, 2026
· release notes
ZIA adds Oracle Financials SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. , network share CIDR CIDR A notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. /Regex, endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM, custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. on public cloud, firewall filtering API filter, and recipient email profile APIs.
SSPM Scan checkbox on tenant onboarding for Oracle Financials Cloud tenants%d{txn_delay_req} and %d{txn_delay_resp} in NSS Feed Output Format for web logsSupport for CIDR ranges and regular expressions when creating or editing Network Share DLP resources Support for specifying a network type (Trusted, Off-Trusted, VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. ) on Endpoint DLP policy rules for the Network Share, Printing, and Device Control channels ruleLabelId query parameter on GET /firewallFilteringRules and GET /firewallFilteringRules/count endpoints to filter by rule label ID
+4 more
show less
CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for recipient email profiles: POST /emailRecipientProfile, GET /emailRecipientProfile, GET /emailRecipientProfile/{profileId}, PUT /emailRecipientProfile/{profileId}, DELETE /emailRecipientProfile/{profileId}, GET /emailRecipientProfile/countCustom IPS rules deployable on Zscaler public cloud (zscalerone.net) with dynamic validation and a limit of 1,000 rules Save & Promote button to trigger dynamic validation and Promote All button for Custom IPS signature rules on the Custom Signature Rules pageExpanded SSPM coverage for Salesforce with three new controls
9 details in Everything
└──▷ BREAKING ON UPGRADE
! UI labels SSL Inspection and SSL Policy renamed to SSL/TLS Inspection and SSL/TLS Policy across the Admin Console navigation.
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-03-06
Mar 6, 2026
· release notes
Cloud & Branch Connector adds API endpoints for Azure account management and raises the subscription limit to 128.
Workflow Automation — Release Upgrade Summary (2026) — 2026-03-05
Mar 5, 2026
· release notes
Workflow Automation adds new merge tags for notification templates and supports apostrophes/hyphens in email addresses
Adds External Collaborators , External Recipients , Internal Collaborators , Internal Recipients , Manager Email , and Manager Name merge tags to custom Email, Slack, and Microsoft Teams notification templates Expands email address input validation across Approvers, Integration Users, Incident Details, Custom Workflows, Import CSV, Incidents, and Incident Summary pages to accept apostrophes and hyphenated characters
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-05
Mar 5, 2026
· release notes
ZPA ML resource group recommendations now include agent groups and custom tags; new redundancy support for Network Connectors.
ML-based Microsegmentation Resource Group Recommendations now factor in Agent Group membership and custom type tags to improve recommendation accuracy Network Connectors now support redundancy via EBGP routing, enabling ECMP load balancing and automatic failover across nodes, links, and data centers
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-03-03
Mar 3, 2026
· release notes
ZPA adds credential agent for PRA, ZIA traffic inspection with multimatch, and LSS business continuity logging
Adds a new credential agent for Privileged Remote Access (PRA) to enable integration with Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. and Microsoft Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. for credential discovery. Adds capability to deploy the credential agent via the Zscaler Admin Console to automate privileged credential lifecycle management, including LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. /search queries, rotation policies, and credential pools. Enables ZIA traffic inspection for Application Segments when Multimatch and Pattern Matching are enabled. Supports streaming logs directly to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. receivers using Log Streaming Service (LSS) App Connectors for Business Continuity events.
4 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2026) — 2026-03-03
Mar 3, 2026
· release notes
Private Service Edge details drawer now shows Host Platform field for hardware appliances.
Private Access (ZPA) — App Connector Release Summary (2026) — 2026-03-03
Mar 3, 2026
· release notes
App Connector 26.52.3 adds group-level Local OS Network Settings and UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. App Segment selection.
Adds support for editing Local OS Network Settings (routes, DNS, SSH) at the App Connector group level and executing remote commands. Enables selection of the closest App Connector to an application when configuring application segments that include UDP ports.
2 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-03-02
Mar 2, 2026
· release notes
Zscaler Client Connector 4.8 adds Auth Service integration, Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. refresh, Z-Tunnel 2.0 DR, process bypass, and CrowdStrike posture checks.
Adds support for Authentication Service integration, enabling Digital Experience without ZIA/ZPA, device group usage, machine tunnel authentication, OTPs, device quarantine, and service disable reason display Enhances CrowdStrike ZTA posture with two new device posture checks: CrowdStrike ZTA Device OS Score and CrowdStrike ZTA Sensor Setting Score Adds support for forcing a Kerberos ticket refresh after ZPA reauthentication Adds failover settings to the app profile that can override the global fail over settings Supports a device posture check for specific Zscaler Client Connector versions
+2 more
show less
Supports process-based application bypass using custom application bypasses defined in the Zscaler Client Connector Portal when using Transparent Proxy-based Traffic Interception Adds a new traffic forwarding action for ZIA Disaster Recovery to forward traffic using Zscaler Tunnel (Z-Tunnel) 2.0
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-03-02
Mar 2, 2026
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type Control for RPM files and REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. for DNS application groups.
└──▷ TRY IT
Use the new API endpoints to programmatically create or update DNS application groups for ZIA firewall policies.
copy
$ POST /dnsApplicationGroups
Retrieve a list of all DNS application groups using the lite endpoint to reduce payload size.
copy
$ GET /dnsApplicationGroups/lite
File Type Control and DLP policies now support RPM files in the Archive category Adds GET /dnsApplicationGroups, POST /dnsApplicationGroups, GET /dnsApplicationGroups/{groupId}, PUT /dnsApplicationGroups/{groupId}, DELETE /dnsApplicationGroups/{groupId}, and GET /dnsApplicationGroups/lite endpoints to manage DNS application groups
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-03-02
Mar 2, 2026
· release notes
Zscaler UVM adds Apache Kafka outegration and manual asset scan triggers for Tenable scanners.
Adds Apache Kafka outegration to publish entity data to an external topic for event-driven ticket ingestion Enables manual trigger of asset scans via the Assets page, asset drawer, or ticket drawer to validate remediation immediately
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-03-02
Mar 2, 2026
· release notes
Adds an Apache Kafka integration to publish entity data for event-driven architectures.
Enables publishing Zscaler Data Fabric for Security entity data to an external Apache Kafka topic via the new Apache Kafka Outegration . Provides a mechanism to ingest ticket events into event-driven architectures.
2 details in Everything
Secure Access to AI Apps — Release Upgrade Summary (2026) — 2026-02-27
Feb 27, 2026
· release notes
AI Guard 2.10 adds Splunk log export, Google Gemini Workspace provider, enhanced PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. viz, and audit diff details.
Splunk Integration allows exporting AI Guard logs to Splunk for centralized monitoring and analysisGoogle Gemini Workspace Support (Initial Release) enables Google Gemini as a new User Mode Provider for policy enforcement in Google Docs Enhanced PII Detection Visualizations add graphical elements on the Insights page for PII detections, categories, and variations
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-02-27
Feb 27, 2026
· release notes
Adds GET /snapshot/alert and GET /snapshot/user API endpoints for sharing ZDX snapshots.
Adds /snapshot/alert endpoint to share a ZDX Snapshot for a given alert ID to evaluate alert details Adds /snapshot/user endpoint to share a ZDX Snapshot for a given user ID to monitor user details about device and application use
2 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-02-27
Feb 27, 2026
· release notes
Client Connector 4.7.0.223 adds strict enforcement with PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. exclusions and hardware offloading controls.
Supports blocking all traffic and allowing only PAC file exclusions when in strict enforcement mode. Supports controlling how Zscaler Client Connector interacts with hardware offloading on network adapters to resolve compatibility issues.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-27
Feb 27, 2026
· release notes
ZIA adds ruleLabelId API filter, recipient email profile endpoints, SSpm Salesforce controls, bandwidth latency fields, and cert auth for MS connectors.
Adds ruleLabelId query parameter to GET /firewallFilteringRules and GET /firewallFilteringRules/count endpoints to filter by rule label ID Adds REST endpoints for recipient email profiles: POST /emailRecipientProfile, PUT /emailRecipientProfile/{profileId}, DELETE /emailRecipientProfile/{profileId}, and count/list variants Adds three new SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls for Salesforce via the Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management feature Adds latency columns (Request Latency Due to Bandwidth Control (ms), Response Latency Due to Bandwidth Control (ms), Total Latency Due to Bandwidth Control (ms)) and NSS feed fields %d{txn_delay_req} and %d{txn_delay_resp} for bandwidth control visibility Adds certificate-based authentication option (private key) for custom Zscaler connectors with Microsoft applications
5 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-02-26
Feb 26, 2026
· release notes
Zscaler Client Connector 4.8.0.140 adds strict traffic blocking mode and hardware offloading controls for Windows
Supports blocking all traffic and allowing only PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file exclusions when in strict enforcement mode. Adds configuration control for hardware offloading interaction with network adapters.
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-02-26
Feb 26, 2026
· release notes
UVM adds Remediation Copilot, an AI-guided in-ticket chat assistant for fix paths and mitigations
Adds Remediation Copilot, an AI-guided remediation assistant available directly in UVM tickets, providing context-aware fix paths based on findings, affected assets, and environment. Enables users to save a summary of Remediation Copilot steps to the ticket's Fixes tab for traceability.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-24
Feb 24, 2026
· release notes
ZPA adds support for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels connected from Private Service Edges to public VPN Service Edges
Workflow Automation — Release Upgrade Summary (2026) — 2026-02-23
Feb 23, 2026
· release notes
Workflow Automation adds granular custom date ranges, new incident columns for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and integration name mappings.
Adds hour, minute, and second fields to the Custom Date Range filter on the Incidents page, Incident Summary page, and Incident Analytics dashboard Adds Component, Content Location, Workspace, and Domains columns to the Incidents page incident table and export file for Source DLP type SaaS Security incidents Adds Component, Content Location, Domains, and Workspace as filter options in the Filters window for Source DLP type SaaS Security incidents Adds Component, Content Location, Domains, and Workspace as merge tags to Email, Slack, and Microsoft Teams notification templates Adds Component, Content Location, Domains, and Workspace as mapping properties on the Incident Group Mapping page and Workflow Mappings page for Source DLP type SaaS Security incidents
+2 more
show less
Adds Integration Name property to Incident Group Mapping page and Workflow Mappings page for incidents of Source DLP types Inline, Email, Endpoint, and SaaS Security Adds a Refresh button to the top of the Incidents page and Incident Details page to reload incident data
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-23
Feb 23, 2026
· release notes
ZIA adds REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for DNS application groups CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. on zscaler.net and zscloud.net
Adds GET /dnsApplicationGroups, POST /dnsApplicationGroups, GET /dnsApplicationGroups/{groupId}, PUT /dnsApplicationGroups/{groupId}, DELETE /dnsApplicationGroups/{groupId}, and GET /dnsApplicationGroups/lite endpoints to the ZIA API on zscaler.net.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-20
Feb 20, 2026
· release notes
ZIA adds onPremNss and ruleLabelId API query params, REST CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for emailRecipientProfile, granular admin role separation, and SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Read-only connector option.
Adds onPremNss Boolean query parameter to /nssFeeds endpoints (GET, POST, PUT, DELETE) to request on-premises Nanolog Streaming Service feeds Adds ruleLabelId query parameter to GET /firewallFilteringRules and GET /firewallFilteringRules/count to filter firewall rules by label ID Adds REST endpoints (GET, POST, PUT, DELETE, GET /count) for creating and managing recipient email profiles via /emailRecipientProfile Splits Admin Role permissions for URL Filtering and Cloud App Control in the Policy & Components > Access Control tab for more granular access control Introduces Read-only connector option for SSPM scans on GitHub, Jira, Okta, Confluence, Trello, Webex Teams, and Google Workspace to enable least-privilege posture assessments
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-18
Feb 18, 2026
· release notes
ZIA adds flexible permission selection (Read-only vs Read/Write) for SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. connector onboarding to support least-privilege access.
Adds Read-only connector role option for GitHub, Jira, Okta, Confluence, Trello, Webex Teams, and Google Workspace SSPM tenants to avoid default Read/Write (full access) permissions
1 detail in Everything
Zero Trust Branch — Release Upgrade Summary (2026) — 2026-02-18
Feb 18, 2026
· release notes
Zero Trust Branch 8.1.1 adds ZPA Microtenant support, Active-Active HA, BGP BGP A routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. advertisement and a new ztb-console CLI.
Adds ZPA Microtenant registration during site provisioning to access application segments Adds BGP Advertisement for Private Access synthetic IP addresses into the LAN-side network Enables Active-Active high availability deployment mode for WAN appliances and App Connectors Supports Static Mapping of FQDN app segments to synthetic IP addresses from the 100.70.0.0/16 range Introduces ztb-console as the new primary CLI command to access the console (renamed from airgap-console)
+1 more
show less
Updates UI terminology: renames Airgap VLAN to VLAN, Airgap-Lite to Network Segmentation , and Airgap Gateway Configuration to Zero Trust Branch Appliance Configuration
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-17
Feb 17, 2026
· release notes
ZPA adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment for App Connectors and new UI elements in App Connector Groups management.
Enables OAuth 2.0 enrollment for App Connectors as the recommended method alongside provisioning key enrollment Adds a new column in the App Connector Groups table displaying the number of associated App Connectors Introduces an App Connectors tab on the App Connector Groups details page Allows signing certificates to be selected and associated directly with an App Connector Group via the Details tab Adds an Update Settings tab in App Connector Groups for configuring version profiles and update frequency
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-17
Feb 17, 2026
· release notes
ZIA adds granular Read-only vs Read/Write permission selection for SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. connector onboarding
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-02-17
Feb 17, 2026
· release notes
Zscaler UVM adds SLA SLA A formal agreement between a service provider and customer that defines expected uptime, response times, and remedies for failures, giving cyber tools a contractual baseline for availability and support commitments. calculation based on active findings to focus remediation timelines.
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-02-17
Feb 17, 2026
· release notes
Cloud & Branch Connector gains AWS endpoint ID in logs, ZPA pattern matching, VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. username visibility, and GCP MIG autoscaling.
Adds Endpoint/Interface filter and column to Session Insights Logs for AWS VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint IDs Supports ZPA policy evaluation with hostname patterns instead of exact FQDNs in application segments Enables username visibility in multisession VDI environments via the Zscaler Client Connector for VDI application Releases VM version zs-cc-ga-02042026 to support Managed Instance Group (MIG) autoscaling on Google Cloud Platform
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-16
Feb 16, 2026
· release notes
ZIA adds DNS application group REST endpoints and macOS Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. capabilities including print blocking, clipboard/file access controls, and new dictionary support
Adds API endpoints for managing DNS application groups on zscalerone.net: GET /dnsApplicationGroups, POST /dnsApplicationGroups, GET/PUT/DELETE /dnsApplicationGroups/{groupId}, and GET /dnsApplicationGroups/lite Adds Endpoint DLP Block Action for printing on macOS devices within content inspection rules Adds Endpoint DLP support for monitoring and blocking sensitive data via Clipboard channel and Application File Access channel on macOS Adds Removable Storage rule capability to map multiple removable storage devices to specific users or endpoints, with CSV import support Adds configurable End User Reports for Endpoint Data Scan to show local sensitive data locations and best practices
+5 more
show less
Adds granular Endpoint DLP configuration controls including End User report visibility/scheduling/exclusions, classification file size/timeout fallbacks, Protect action hiding, and Application Inventory Scan controls Adds Sensitive Information Index Document Match (IDM) for endpoint-based document indexing and exfiltration detection on ZIA Adds new predefined DLP dictionaries: CNPJ Number (Brazil), IBAN, National Economic Registry Number (Poland), Passport Number (Asia) Adds 15-byte prefix and suffix context to Endpoint DLP triggers visible in Incident Receiver, Workflow Automation, and Email Notifications Adds Proximity Length field support for applicable predefined DLP dictionaries in Endpoint DLP engines
10 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-02-13
Feb 13, 2026
· release notes
Zscaler Client Connector 4.5.1 adds Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket clearing, strict enforcement blocking, and process-based macOS bypasses.
Adds an option to clear the Kerberos ticket after Zscaler Private Access (ZPA) reauthentication to force a Kerberos ticket refresh Adds an option to check for specific software versions for device postures on Windows: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender Adds the ability to enter process-based applications for macOS and select them in the Global Bypasses section of the macOS app profile Adds an option to block all traffic and allow only PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file exclusions when in strict enforcement mode Updates the Zscaler Client Connector Portal to always use the V8 JavaScript based PAC Parser regardless of the setting in a user’s app profile
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Devices with Zscaler Client Connector versions 1.x and 2.x (Windows, macOS, iOS, Android) or version 1.5 and earlier (Linux) can no longer enroll.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-13
Feb 13, 2026
· release notes
ZIA adds Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for JumpCloud and async Insights Logs with CSV export
Adds support for configuring Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) for JumpCloud tenants Adds asynchronous log retrieval for Insights Logs via the Export in Background option Allows exporting up to 1 million records to a CSV file with a custom filename Renames the Apply Filters button to Run Query in the Insights Logs interface
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-02-13
Feb 13, 2026
· release notes
Zscaler ZTG support added for AWS me-south-1, eu-north-1, and eu-south-2 regions.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-11
Feb 11, 2026
· release notes
ZPA Private Access introduces Access Policies for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. (for Legacy Apps) with rules management and Address Book
Adds Access Policies for VPN (for Legacy Apps) capability allowing allow/block traffic on VPN Service Edges Introduces Address Book page to manage reusable IP addresses and CIDRs for policy rules Enables rule ordering via the Rule Order column and filtering/search on the Rules page
3 details in Everything
Deception — Release Upgrade Summary (2026) — 2026-02-11
Feb 11, 2026
· release notes
Adds GCP cloud deception support with service account, Cloud Storage, Cloud SQL, Secret Manager, Artifact Registry, Gen AI MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server decoys
Adds GCP as a supported platform for cloud deception, enabling deployment of GCP-specific resources as decoys from the Zscaler Deception Admin Portal. Adds support for Service Account, Cloud Storage, Cloud SQL, Secret Manager, and Artifact Registry as configurable decoy types in GCP. Introduces Cloud Lures feature to deploy GCP service account decoys in endpoints via landmine policies to detect adversarial interactions with other GCP decoys. Adds new Gen AI MCP server decoy capability, allowing deployment of a decoy that mimics a standard Model Context Protocol Model Context Protocol Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCP) server for AI applications or LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. chatbots.
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-02-09
Feb 9, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI model scanning, Azure Cosmos DB support, OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. scans, action rules and CLI init command.
Adds Action Rules to automatically apply Microsoft Information Protection sensitivity labels based on data type criteria for Azure File Shares. Adds new threat categories AI Governance and AI Safety for assessing AI governance and safety posture. Adds scanning of AI Models to identify vulnerabilities like malicious code injection, backdoors, embedded secrets, and data leakage via the AI Model Security Scan Findings page. Adds support for scanning AWS ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. images for vulnerabilities with visibility into model usage, licensing, versions, and security. Adds visibility into deployed Azure AI Agents and the sensitive data they access.
+8 more
show less
Adds discovery of GCP Vertex AI, its access to sensitive data, entitlement, and posture. Adds a new CLI command to initialize the on-premises scanner VM, simplifying network configuration and component installation. Adds new data posture policies for AWS, Azure, GCP, and Snowflake, including specific checks for Azure Databricks, Azure Storage, Azure AI Foundry, Azure OpenAI, Azure Unmanaged MongoDB, GCP BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. , and Snowflake. Adds support for discovering and classifying sensitive data in Azure Cosmos DB accounts. Adds Optical Character Recognition (OCR) scanning for images containing sensitive data like credit card numbers. Adds discovery and classification of sensitive data stored in the Data Files Storage of the Azure OpenAI service. Adds Has Data predicate to investigation and policy queries for metadata analysis of resources within Azure AI Foundry. Adds new posture labels for resource types including Public Exposure, Encryption, Logging, Backup, Exposed to AI Services, Guardrails, and more across Azure Cosmos DB, AWS ECR, GCP Vertex AI, MongoDB, and Microsoft Foundry.
13 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-02-09
Feb 9, 2026
· release notes
UVM adds Microsoft Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. device owner stream and Wiz Assets connector with network exposure enrichment.
Adds Entra ID - Devices stream to retrieve registered owners for each device alongside inventory data Adds Wiz Assets Connector to retrieve detailed cloud resource information from the Wiz platform with optional network exposure enrichment
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-02-09
Feb 9, 2026
· release notes
Adds registered owner data to the Microsoft Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. - Devices stream in Asset Exposure Management.
The Entra ID - Devices stream now retrieves registered owners for each device alongside existing inventory fields (device ID, name, OS, compliance, and management fields).
1 detail in Everything
Cloud & Branch Connector — Release Upgrade Summary (2026) — 2026-02-09
Feb 9, 2026
· release notes
Cloud & Branch Connector adds AWS Endpoint ID filtering to Session Insights Logs, ZPA pattern matching for application segments, and GCP MIG autoscaling.
Adds Endpoint/Interface filter and column to Session Insights Logs for AWS VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. endpoint IDs Enables ZPA hostname pattern matching within Application Segments instead of exact FQDNs Supports Managed Instance Group (MIG) autoscaling for Cloud Connector on Google Cloud Platform via VM version zs-cc-ga-02042026
3 details in Everything
Client Connector — Release Upgrade Summary (2026) — 2026-02-06
Feb 6, 2026
· release notes
Zscaler Client Connector 4.5.1 adds ZPA Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. ticket refresh, strict enforcement blocking, and macOS process-based bypasses
Adds option to force a Kerberos ticket refresh after ZPA reauthentication by clearing the ticket. Adds Force ZPA authentication to expire option to immediately reauthenticate ZPA instead of waiting for next access attempt. Updates Portal to always use the V8 JavaScript based PAC Parser in app profiles. Adds option to delay pop-up notifications for device posture failures after tunnel establishment. Adds macOS device posture check for specific Zscaler Client Connector versions.
+4 more
show less
Adds ability to configure process-based applications for macOS and select them in the Global Bypasses section of the macOS app profile. Adds option to block all traffic and allow only PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file exclusions when in strict enforcement mode. Adds Windows device posture checks for specific software versions: Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender. Adds support to block enrollment of devices running very old versions of Zscaler Client Connector (versions 1.x/2.x on Windows/macOS/iOS/Android; 1.5 and earlier on Linux).
9 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-06
Feb 6, 2026
· release notes
ZPA adds agent age-out timers, Kubernetes resource visibility, and tag management for microsegmentation
Adds Agent Age-Out timer to configure automatic expiration of disconnected agents in individual agent groups by days, hours, or minutes Adds visibility into Kubernetes resources (deployments, statefulsets, replicasets, daemonsets) for microsegmentation network flow viewing in the ZPA Admin Portal Adds tag management capabilities allowing creation of namespaces, tag keys, and tag groups to annotate resources for resource group membership criteria
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-02-06
Feb 6, 2026
· release notes
ZDX adds session timeout config and Zoom call quality exclusion criteria to tenant onboarding.
Adds Session Timeout Duration setting to control inactive ZDX Admin Portal access time Adds User groups, Users, and Departments fields in the Monitoring Criteria section for Zoom Call Quality Monitoring Exclusion
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-06
Feb 6, 2026
· release notes
ZIA adds Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for JumpCloud, Sandbox Verdict logging to NSS, and async Insights Log exports with CSV naming
Adds support for Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) scan of JumpCloud tenants via the SSPM Scan checkbox during tenant onboarding Adds Export in Background option and custom CSV filename support to Insights Logs, allowing export of up to 1 million records asynchronously Adds Sandbox Verdict log type for Nanolog Streaming Service (NSS) feeds to stream behavioral analysis logs to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. Adds usersAndGroupsSet, groupsAndDepartmentsSet, groups2, and groups3 fields to the UrlFilteringRule model in the /urlFilteringRules APIs Increases AWS tenant profile limit to 512 account IDs per profile and 4,096 across all profiles
5 details in Everything
Workflow Automation — Release Upgrade Summary (2026) — 2026-02-05
Feb 5, 2026
· release notes
Zscaler Workflow Automation adds incident summaries, policy exceptions for inline DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , email release quarantine, and notification reminders.
Adds Aggregate incident counts view on the Incident Summary page with selectable attributes and filters Logs audit events when generating presigned links from the Violation Content section of an Incident Details page Adds Create Policy Exception action to Inline Source DLP incidents via the Actions menu or a new Policy Exception tile in the custom workflow builder Adds Notification Reminders for unresponded user and escalation notifications, configurable on the Account Settings page Enables releasing quarantined Microsoft emails to selected recipients from Incident Details or via enhanced notification sections (contact support to enable)
5 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-02-05
Feb 5, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Action Rules for auto-labeling, CLI scanner init, AI model scanning, and broad new resource support.
Adds Action Rules feature to define criteria for identifying specific data types and automatically apply Microsoft Information Protection sensitivity labels to files (initially supports Azure File Shares). Introduces AI Governance and AI Safety threat categories for assessing AI governance and safety. Enables scanning of AI models for vulnerabilities such as malicious code injection, backdoors, embedded secrets, and data leakage via the AI Model Security Scan Findings page. Adds support for scanning AWS ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. images for vulnerabilities, with visibility into model usage, licensing, versions, and security vulnerabilities across containerized machine learning workloads. Provides visibility into deployed Azure AI Agents and the sensitive data they have access to.
+8 more
show less
Supports discovery of Google Cloud Vertex AI resources and their access to sensitive data, including entitlement and posture determination. Adds a new CLI command to initialize the on-premises scanner, simplifying network configuration, component installation, and initial connectivity/health checks. Introduces 43 new data posture policies covering AWS (Databricks), Azure (Storage, AI Foundry, OpenAI, Databricks, MongoDB), GCP (BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. ), and Snowflake. Adds scan support for Azure Cosmos DB NoSQL Data Stores to discover and classify sensitive data. Supports Optical Character Recognition (OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. ) scanning for sensitive data in images, including credit card numbers and PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. . Adds discovery and classification of sensitive data stored in the Data Files Storage of the Azure OpenAI service. Enhances investigation and policy queries with the Has Data predicate to query for sensitive data in resources within Azure AI Foundry. Appplies posture labels (e.g., Public Exposure, Encryption, Logging) to new resource types including Azure Cosmos DB NoSQL, Microsoft Foundry Hubs/Agents, AWS ECR, GCP Vertex AI components, MongoDB, and others.
13 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-02-03
Feb 3, 2026
· release notes
Adds UI columns and fields to manage automated software updates for ZPA Private Service Edges and Controllers
Adds Version Profile , Software Update , and Manager Update columns in the table to display version profiles and update status with hover details for target versions and upgrade windows. Adds Last Manager Update time field when viewing details for a ZPA Private Service Edge or Private Cloud Controller. Enables automated software updates for ZPA Manager, Private Service Edges, and Private Cloud Controllers (requires version 25.46.3 or later).
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2026) — 2026-02-03
Feb 3, 2026
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI model scanning, Azure Cosmos DB and ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. support, new CLI scanner init command, and Action Rules for sensitivity labels.
Adds Action Rules to automatically apply Microsoft Information Protection sensitivity labels based on criteria in Azure File Shares Adds a new CLI command to initialize the on-premises scanner VM, configuring network settings and running health checks Adds AI Security capabilities including scanning AI models for vulnerabilities and scanning AWS ECR images for ML workload risks Adds visibility into deployed Azure AI Agents and sensitive data access Adds discovery of GCP Vertex AI resources, their data access, entitlements, and posture
+6 more
show less
Adds new Data Posture Policies for AWS Databricks, Azure Storage/AI/Databricks/MongoDB, GCP BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. , and Snowflake Adds support for discovering sensitive data in Azure Cosmos DB NoSQL stores Adds OCR Scan capabilities to detect sensitive data within images Adds sensitive data discovery in the Data Files Storage of Azure OpenAI Enables using the Has Data predicate in investigation queries to check for sensitive data in Azure AI Foundry resources Applies new Posture Labels (Public Exposure, Encryption, Logging, etc.) to resource types like Azure Cosmos DB, AWS ECR, and GCP Vertex AI
11 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-03
Feb 3, 2026
· release notes
ZIA adds MSIX file type support in DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type Control and MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transaction logs.
Adds MSIX file type support to File Type Control and DLP policies for the Executable category Adds application activity MCP entries to Web Insights Logs to log Model Context Protocol Model Context Protocol Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transactions
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-02-03
Feb 3, 2026
· release notes
Microsoft Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. connector adds Applications stream to retrieve registered apps and owners
Workflow Automation — Release Upgrade Summary (2026) — 2026-02-02
Feb 2, 2026
· release notes
Zscaler Workflow Automation adds custom notification templates with new merge tags for email, Slack, and Teams
Adds the ability to create custom email, Slack, and Microsoft Teams notification templates in the Data Protection integration Adds Action , Activity Type , Category , Channel , Confirm Action , Date , Department , Destination , Destination Location , Destination Type , Device Name , Device OS , Device Trust Level , DLP Admin , Document Type , Email Subject , Expected Action , File Link Expiry , File MD5 , File Modified By , File Shared At , File Shared By , File Size , File Source Location , File Type , Is Copilot Accessible , Protocol , Referral URL , Source , Source DLP Type , Source Location , Source Type , and URL as available merge tags in notification templates Removes Destination URL and Operation merge tags from notification templates
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-02-02
Feb 2, 2026
· release notes
ZIA adds Airtable, Bitwarden, Sentry, and OneLogin integrations to Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. .
Advanced SSPM adds Airtable as a supported platform for onboarding tenants via the 3rd-Party App Governance Admin Portal. Advanced SSPM adds Bitwarden as a supported platform for onboarding tenants via the 3rd-Party App Governance Admin Portal. Advanced SSPM adds Sentry as a supported platform for onboarding tenants via the 3rd-Party App Governance Admin Portal. Advanced SSPM adds OneLogin support as an API-based platform for onboarding tenants via the 3rd-Party App Governance Admin Portal.
4 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-02-01
Feb 1, 2026
· release notes
New Dragos connector for OT asset and vulnerability data.
Client Connector — Client Connector App Release Summary (2026) — 2026-01-30
Jan 30, 2026
· release notes
Client Connector 4.8.0.115 adds RSC control via App Profiles and fixes posture/proxy issues
Adds support for controlling how Zscaler Client Connector interacts with the Receive Segment Coalescing (RSC) feature on network adapters to resolve compatibility issues.
1 detail in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-26
Jan 26, 2026
· release notes
New HCL BigFix Computers and three SentinelOne connector streams for asset and security data ingestion.
Adds HCL BigFix Computers connector to retrieve computer IDs, hostnames, OS, IP, and hardware details Adds SentinelOne Assets stream to ingest managed devices, cloud assets, and unmanaged devices Adds SentinelOne Alerts stream to ingest security alerts for centralized monitoring in Zscaler SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Adds SentinelOne CNS Findings stream to ingest vulnerabilities and misconfigurations from xSPM module
4 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-26
Jan 26, 2026
· release notes
Adds HCL BigFix Computers and SentinelOne connectors with new asset, alert, and xSPM finding streams to Zscaler Asset Exposure Management.
Adds the HCL BigFix Computers connector which retrieves computer IDs, hostnames, OS details, IP addresses, and hardware properties from a BigFix deployment Adds three new SentinelOne connector streams: SentinelOne Assets for managed/unmanaged/cloud endpoints, SentinelOne Alerts for security alerts, and SentinelOne CNS Findings for xSPM vulnerabilities and misconfigurations
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-25
Jan 25, 2026
· release notes
Mandiant ASM ASM Attack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. connector available to retrieve entities and issues.
└──▷ HOW TO FIND IT
Configure the UVM service to ingest attack surface attack surface The exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. data.
📍 Configuring the Mandiant ASM Connector
Adds the Mandiant ASM connector integration Supports Mandiant ASM Entities stream (domains, IPs, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. certs) Supports Mandiant ASM Issues stream (misconfigs, vulnerabilities)
3 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-25
Jan 25, 2026
· release notes
New Mandiant ASM ASM Attack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. connector for AEM to ingest assets and issues
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-21
Jan 21, 2026
· release notes
ZIA adds MCP MCP Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transaction logging, MSIX DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type support, Atlassian AI controls, adjustable SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scan intervals, DLP collaborator scoping, and password-protected PDF sand
Embedded AI and Embedded AI Prompts fields added to the Add/Edit Productivity and CRM Tools Rule window for granular control of embedded AI applications on Atlassian sites.MCP application activity added to Web Insights Logs to log Model Context Protocol Model Context Protocol Model Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. transactions in the ZIA Admin Portal.MSIX files supported in the Executable category for File Type Control and Data Loss Prevention (DLP) policies. Admin Quarantine action available on the Edit DLP Rule window for quarantining files from all file sharing apps (Box, Dropbox, Confluence, ShareFile, Smartsheet) to a desired location.Number of internal and external collaborators added as scoping criteria for SaaS Security Data at Rest Scanning DLP policies for file sharing applications.
+2 more
show less
Polling interval configurable in Policy > SaaS Security > Scan Configuration > Add Scan Schedule for SaaS application tenants.Zscaler Isolation now supports sandboxing sandboxing Running code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. password-protected PDF files for ZIA; users are prompted for the password within the isolated session.
7 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-21
Jan 21, 2026
· release notes
Zscaler UVM introduces redesigned ticket workflows with status management, scope locking, and auto-dispatch capabilities
Adds Ticket Status Management workflow category to automate ticket closing, reopening for resurfaced findings, and custom status transitions Adds Lock Ticket Scope Triggers mechanism to automatically lock ticket scope upon manual splits or merges, preventing subsequent automated modifications Adds Auto-Dispatch to External Systems capability to trigger third-party work items and alerts based on specific ticket criteria
3 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-21
Jan 21, 2026
· release notes
AEM adds Violation Ticket Lifecycle settings for statuses and workflow automation.
Adds Violation Ticket Statuses to define status buckets for violation tickets Adds Violation Ticket Workflows to configure automated rules for ticket progression and external dispatch
2 details in Everything
Zero Trust Branch — Release Upgrade Summary (2026) — 2026-01-21
Jan 21, 2026
· release notes
Zero Trust Branch 8.0.8P2 improves ZPA provisioning reliability, DHCP relay stability for inactive VLANs, bonded interface MAC handling, PBR Balanced mode WAN link awareness, and HA status display correctness post-upgrade.
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-20
Jan 20, 2026
· release notes
ZIA adds logical operators in URL filtering UI and new API fields for grouped criteria
Adds usersAndGroupsSet, groupsAndDepartmentsSet, groups2, and groups3 fields to the UrlFilteringRule model in the /urlFilteringRules APIs. Enables granular URL Filtering Policy rules by allowing OR or AND logical operators between Users, Groups, and Departments criteria via the UI.
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-20
Jan 20, 2026
· release notes
UVM data source mapping now supports exploding a single array field into multiple output records.
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-20
Jan 20, 2026
· release notes
Data Source Mapping now supports exploding single array fields into multiple output records.
Authentication Service — Release Upgrade Summary (2026) — 2026-01-19
Jan 19, 2026
· release notes
OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Client Credentials supported for SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. provisioning
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-19
Jan 19, 2026
· release notes
ZIA enhancements to Zscaler Cloud Performance Test Tool hide usernames in traffic/email views.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2026) — 2026-01-16
Jan 16, 2026
· release notes
ZDX now supports IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. visibility and stores logs in Canada.
Enables storage of ZDX logs and data in Canada alongside existing US, EU, Singapore, and Australia East regions.
1 detail in Everything
Authentication Service — Release Upgrade Summary (2026) — 2026-01-16
Jan 16, 2026
· release notes
Zscaler Authentication Service integrates Management Portal for Partners with SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-16
Jan 16, 2026
· release notes
New Sandbox Verdict logging, AWS profile scaling to 512 accounts, email time fields, and Virtual Service Edge resource increases.
Adds new Sandbox Verdict NSS log type to stream sandbox analysis data to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems Adds %s{zs_rcv_time} and %s{zs_sent_time} fields to NSS Feed Output Format for Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. logs Increases AWS account ID limit to 512 per tenant profile in Tenant Profiles Adds Zscaler Sent Time and Zscaler Received Time columns to Email DLP Insights Logs Enables Virtual Service Edge deployment with 64 GB RAM RAM Working memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. and 3 AV engines on VMware ESXi, Azure, GCP, Hyper-V, AWS, and AWS with GWLB
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Deprecation of SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. policies Set Automated Notifications for New and Trending Cloud Applications in Our Organization and Set Automated Notification for New OAuth Applications Connected to Your Corporate Environment for Microsoft 365
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-15
Jan 15, 2026
· release notes
ZIA sandbox now analyzes ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. optical disc image files across all cloud platforms
Adds iso (Optical Disc Image) file type support to the Zscaler Sandbox
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-01-13
Jan 13, 2026
· release notes
ZPA Private Access adds Extranet client type for access policies and cloud API
Adds Extranet as a new client type in access policies, supporting location and sublocation criteria for partner segment assignment Exposes Extranet client type configuration via the Private Access cloud service API
2 details in Everything
Client Connector — Client Connector App Release Summary (2026) — 2026-01-13
Jan 13, 2026
· release notes
Client Connector 4.1 adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, Z-Tunnel 2.0 bypass options, and Authentication Service management features.
Adds Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic options for the Z-Tunnel 2.0 protocol bypass feature Enables IPv6 traffic forwarding from IPv6-only Android devices to ZIA and ZPA Adds force remove, quarantine/unquarantine, OTP OTP One-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. support, and remote log fetching capabilities for Authentication Service users in the Client Connector Portal Supports packaging the Client Connector Portal configuration into an encrypted log file during export Enables automatic discovery of the optimal path MTU for Z-Tunnel 2.0
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-13
Jan 13, 2026
· release notes
ZIA adds MSIX DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type support, Sandbox Verdict logging to NSS and Insights UI, and Extranet App Support enhancements
Adds Sandbox Verdict as a new log type for NSS feeds to stream sandbox analysis data to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. Adds Sandbox Verdict Insights Logs page (Analytics > Sandbox Verdict Insights) to view behavioral analysis activity logs in the ZIA Admin Portal Adds MSIX file support to File Type Control and DLP policies in the Executable category Enables bidirectional configuration for Extranet Application Support with custom IP pools, static IPs, GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels, sublocations, Firewall Control, and IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control Adds Extranet Resource filter and column to DNS, Firewall, and Web Insights Logs
+1 more
show less
Adds %s{extranet_name} field to NSS/Web, NSS/Firewall, and NSS/DNS log outputs
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-12
Jan 12, 2026
· release notes
ZIA adds Sandbox Verdict insights logging and NSS feed support; scopes for partner admin management.
Introduces the Sandbox Verdict Insights page (Analytics > Sandbox Verdict Insights) in the ZIA Admin Portal to view recent sandbox analysis activity logs. Adds a new Sandbox Verdict log type available for configuring in the Nanolog Streaming Service (NSS) or Cloud NSS feeds to stream sandbox analysis data to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems. Introduces scopes as a new method to manage multi-tenant, multi-cloud admin and tenant assignments for partners via Authentication Service.
3 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-12
Jan 12, 2026
· release notes
Adds Aqua Security connector to UVM for retrieving cloud-native security data across 7 streams.
Adds Aqua Security Connector integration to retrieve vulnerability data for functions, hosts, container images, running containers, cloud misconfigurations, compliance violations, and security alerts.
1 detail in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-12
Jan 12, 2026
· release notes
Zscaler AEM adds Aqua Security connector for cloud-native security data.
Risk360 — Release Upgrade Summary (2026) — 2026-01-09
Jan 9, 2026
· release notes
Risk360 adds CSV framework export, technique search on compliance pages, and notes management.
Adds ability to download the risk framework as a CSV file Adds search functionality for techniques by name or mapped factor on compliance framework pages Enables adding, editing, or deleting notes for techniques in frameworks and via the Details drawer on the Factors page
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-09
Jan 9, 2026
· release notes
ZIA adds Hyper-V and Nutanix NSS support, URL filter OR/AND operators, AWS tenant profile limits, performance tool masking, and API status workflow changes
Adds Hyper-V support for Nanolog Streaming Service (NSS) VM deployment to stream logs to a SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. system. Adds Nutanix support for Nanolog Streaming Service (NSS) VM deployment to stream web or firewall logs to a SIEM system. Enables OR and AND logical operators between Users, Groups, and Departments criteria in URL Filtering Policy rules. Adds up to three additional Groups fields (groups2, groups3) to the Add/Edit URL Filtering Rule window for granular group-based filtering. Adds usersAndGroupsSet, groupsAndDepartmentsSet, groups2, and groups3 fields to the UrlFilteringRule model in the /urlFilteringRules API.
+3 more
show less
Increases AWS account ID limits in Tenant Profiles to 512 per profile and 4,096 across all profiles. Adds username masking in the Zscaler Cloud Performance Test Tool, displaying only domain parts of traffic or email (e.g., xxxxxxxxx@zscaler.com). Changes Admin Audit and Event Logs API report generation endpoints to return an HTTP 200 status code with a statusId query parameter instead of a 204 code.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! The POST /auditlogEntryReport and POST /eventlogEntryReport endpoints now return an HTTP 200 status code with a statusId in the response body (previously 204), requiring scripts to parse and pass this statusId as a query parameter in subsequent calls to check status, download, or cancel the report.
Deception — Release Upgrade Summary (2026) — 2026-01-09
Jan 9, 2026
· release notes
Adds RADIUS RADIUS A networking protocol for centralised authentication, authorisation, and accounting of users connecting to a network, maintained under IETF standards. Cyber tools use it to integrate with existing enterprise identity infrastructure. decoys, Terraform support for Cloud Deception, and VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. configuration options for AWS RDS/VM image decoys.
Deploys RADIUS decoys via Internal decoys to mimic real RADIUS servers and lure attackers. Adds Terraform package for provisioning Zscaler Deception components and decoys in AWS and Azure. Allows specifying VPC or subnet information when deploying RDS and VM image decoys in AWS.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Deploying RDS and VM image decoys in the default VPC is no longer supported.
Private Access (ZPA) — Release Upgrade Summary (2026) — 2026-01-08
Jan 8, 2026
· release notes
Adds interactive Application Map for Microsegmentation to visualize network data and aid policy configuration
Introduces the Application Map UI feature providing an interactive graph with widgets for resource groups, Public Internet, and VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. /VNET data
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-08
Jan 8, 2026
· release notes
ZIA APIs return statusId for log reports; POST no longer returns 204
POST /auditlogEntryReport and POST /eventlogEntryReport now return HTTP 200 with a statusId field (previously returned 204).
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! Existing scripts relying on POST returning 204 will fail to capture the required statusId for subsequent status checks or downloads.
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-08
Jan 8, 2026
· release notes
Zscaler UVM adds ability to save customized table layouts for widget items.
Allows saving customized table layouts (column order, visibility) for widget items, which are automatically reusable across widgets and dashboards.
1 detail in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-08
Jan 8, 2026
· release notes
AEM adds Saved Views for widget table layouts to persist column customizations across dashboards
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-07
Jan 7, 2026
· release notes
ZIA supports password-protected PDF sandboxing sandboxing Running code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. , adjustable SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scan intervals, and new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scoping/quarantine actions for file sharing apps.
Sandboxing of password-protected PDF files now available in ZIA Isolation New SaaS Tenants tab added to the Settings page in 3rd-Party App Governance and Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. New Notifications tab added to the Settings page for Slack and email configuration New Connect drop-down menu on the App Dashboard to select platforms for 3rd-Party App Governance or Advanced SSPM Adjustable polling intervals now configurable for SaaS application scan schedules (Policy > SaaS Security > Scan Configuration > Add Scan Schedule)
+2 more
show less
Number of internal/external collaborators now supported as a scoping criterion in SaaS Security DLP policies for file sharing apps Admin Quarantine action now available for all tenants with defined quarantine location in the Edit DLP Rule window
7 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-07
Jan 7, 2026
· release notes
UVM adds automatic aging of findings for inactive assets in the console.
Client Connector — ZDX Module Release Summary (2026) — 2026-01-06
Jan 6, 2026
· release notes
ZDX Module 4.6.2.15 adds auto-retry for direct TPG timeouts via system proxy and fixes Notifications tab UI.
Enhances proxy handling by retrying with the system-configured external proxy when direct TPG connections time out.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2026) — 2026-01-06
Jan 6, 2026
· release notes
ZIA updates Isolation to handle password-protected PDFs via Sandbox inspection.
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2026) — 2026-01-06
Jan 6, 2026
· release notes
UVM now ingests external policy compliance and application inventory data from Rapid7 InsightVM and Veracode respectively via new limited-availability streams.
Adds Rapid7 InsightVM Policy Compliance stream to ingest policy compliance data via async export jobs and Parquet files Adds Veracode Applications stream to retrieve a paginated list of applications from the Veracode connector
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2026) — 2026-01-06
Jan 6, 2026
· release notes
Asset Exposure Management adds OS End of Life policy coverage for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. , ESXi, iOS, and new integration streams for Rapid7 InsightVM and Veracode.
Adds support for RHEL (Red Hat Enterprise Linux), VMware ESXi, Apple iOS, IBM AIX, Oracle Linux, Oracle Solaris, Rocky Linux, FortiOS, PAN-OS, and SLES (SUSE Linux Enterprise Server) to the OS End of Life policy. Adds Rapid7 InsightVM Policy Compliance stream integration for ingesting compliance data via asynchronous export jobs downloaded as Parquet files. Adds Veracode Applications stream integration for retrieving a paginated list of applications from Veracode.
3 details in Everything
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-12-31
Dec 31, 2025
· release notes
Zscaler EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds a phishing alert icon on the Lookalike Domains tab and Insights widget.
Adds a phishing alert icon to the Lookalike Domains tab for detected lookalikes Displays phishing alert count in the Top 5 Lookalike Domains by Exposure widget on the Insights Overview dashboard
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-12-31
Dec 31, 2025
· release notes
Adds SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. Platform Script Editor testing component and limited-availability Endor Labs connector
Adds Test Logic panel in the Script Editor to run Python mapping logic against sample records for validating transformations. Adds Endor Labs connector in limited availability to retrieve SCA, container, secrets, and SAST SAST Static application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. findings from specific namespaces using the Query API.
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2025) — 2025-12-30
Dec 30, 2025
· release notes
Zscaler UVM introduces Ticket Lifecycle settings for managing status buckets and automated workflow rules.
Adds Ticket Statuses feature to manage ticket status buckets Adds Ticket Workflows feature to configure automated progression rules and external dispatch
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2025) — 2025-12-23
Dec 23, 2025
· release notes
UVM adds failure alert notifications for ETL/workflows and limited availability GitHub Advanced Security and Ionix connectors.
Enables email notifications for errors in outegration workflows, source run failures, and ETL/data pipeline issues. Adds a GitHub Advanced Security - Code Scanning connector to retrieve code scanning data from GitHub repositories. Adds a GitHub Advanced Security - Secret Scanning connector to retrieve secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. data from GitHub repositories. Adds an Ionix connector supporting Assets and Findings streams with incremental data synchronization.
4 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-12-23
Dec 23, 2025
· release notes
Adds Zscaler Deception entitlement support, tunnel PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. download, registry key posture profiles, and VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass subdomain control.
Adds Zscaler Deception service entitlement for Authentication Service tenants as a supported feature Updates forwarding profile to download the PAC file through the tunnel (Tunnel mode) instead of directly Updates VPN Gateway Bypass to optionally not bypass subdomains for FQDNs Adds support for REG_BINARY type in Registry Key device posture profiles Updates Zscaler Client Connector to monitor system-level proxy configuration changes and enforce settings based on forwarding profile
5 details in Everything
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-12-23
Dec 23, 2025
· release notes
Adds failure alert notifications for ETL and connectors; limited availability GitHub Advanced Security and Ionix connectors.
Enables email notifications for errors in outegration workflows, source run failures, and ETL/data pipeline issues via Enabling Email Notifications for Failures Adds GitHub Advanced Security - Code Scanning connector to retrieve code scanning data including vulnerabilities and misconfigurations Adds GitHub Advanced Security - Secret Scanning connector to retrieve secret scanning secret scanning Checking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. data including exposed API keys, credentials, and tokens Adds Ionix connector for Assets and Findings streams, supporting incremental synchronization and CVE-level details with remediation actions
4 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-12-22
Dec 22, 2025
· release notes
Client Connector 4.7.0.168 adds REG_BINARY support for device posture profiles and monitors system proxy changes.
Adds support for using registry keys with the REG_BINARY type with the Registry Key device posture profile Updates Zscaler Client Connector to monitor changes to the system-level proxy configuration and to enforce the Zscaler proxy settings based on the forwarding profile
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-19
Dec 19, 2025
· release notes
ZPA adds CentOS/RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. platform filters for connectors, machine tunnel user dashboard widget, and RPM updates for RHEL 8/9
Platform filter allows searching App Connector and Private Service Edge pages for obsolete CentOS 7 or RHEL 8/9 package versions Users Dashboard supports a Machine Tunnel Widget showing top 10 users by machine tunnel activity Updated Manager software version 25.50.4 provides RPM packages for App Connectors, PSEs, Private Cloud Controllers, and Network Connectors on RHEL 8.x/9.x
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-19
Dec 19, 2025
· release notes
ZIA adds new API pagination params, log fields, Atlassian AI controls, and adjustable scan intervals.
Adds page and pageSize query parameters to the GET /urlFilteringRules API endpoint for paginated rule retrieval Adds %s{zs_rcv_time} and %s{zs_sent_time} fields to NSS/Cloud NSS feed output formats for email received/sent timestamps Adds Embedded AI and Embedded AI Prompts fields in the Add/Edit Productivity and CRM Tools rule window for Atlassian apps to control embedded AI access and prompt storage Adds adjustable polling interval configuration for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application scan schedules under Policy > SaaS Security > Scan Configuration > Add Scan Schedule Extends DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. quarantining support to Box, Dropbox, Confluence, ShareFile, and Smartsheet with the new Admin Quarantine action in the Edit DLP Rule window
+2 more
show less
Adds ability to scope SaaS Security Data at Rest Scanning DLP policies by number of internal and external collaborators for file sharing apps Updates POST /auditlogEntryReport and POST /eventlogEntryReport endpoints to return HTTP 200 with a statusId instead of 204, requiring script updates to capture and pass statusId for subsequent status/download/cancel requests
7 details in Everything
└──▷ BREAKING ON UPGRADE
! POST /auditlogEntryReport and POST /eventlogEntryReport now return HTTP 200 with a statusId instead of 204, requiring scripts to parse the statusId from the response and pass it as a query parameter to subsequent requests for checking status, downloading reports, or canceling requests
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-18
Dec 18, 2025
· release notes
ZPA adds CentOS/RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. platform filtering for connectors and a Machine Tunnel widget to the Users dashboard.
Adds Platform filter on App Connectors and Private Service Edges pages to search for obsolete CentOS 7 (el7) or identify RHEL 8/9 (el8/el9) package OS versions Adds Machine Tunnel Widget to the Private Access Users dashboard displaying top 10 users by tunnel usage for a selected time frame
2 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-12-18
Dec 18, 2025
· release notes
Incidents page gains User Groups column, filter, and export support
Adds User Groups column to the Data Protection incident table on the Incidents page Adds User Groups attribute as a filter option in the Filters window for incidents Includes User Groups data in incident export files
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-12-18
Dec 18, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds GCP BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. support, AI Inventory risk filters, and on-prem scanner init command
Adds new filter fields (e.g., LLM Safety & Societal Impacts Risk , Model Supply Chain Risk ) in the AI Inventory interface for models and AI Tools & Packages. Adds a single initialization command for deploying on-premises scanners from OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. or VHD images. Adds data discovery support for Azure Germany North region during account onboarding. Adds new posture labels (Logging , Encryption , Public Exposure ) for unmanaged MongoDB, GCP BigQuery, and AWS Databricks resource types. Adds new detection policies for AWS Bedrock, Azure Storage, On-Premises Oracle, Snowflake, and Azure Databricks regarding sensitive data access risks.
5 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-12-17
Dec 17, 2025
· release notes
Client Connector 4.7.0.87 adds process path app identification and tunnel PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. download for macOS.
Adds support for using a process path for application identification in custom VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profiles to handle apps missing Team Identifiers Adds support to download the forwarding PAC file through the tunnel when in Tunnel mode
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-12-17
Dec 17, 2025
· release notes
Users can now define custom coloring for dimensions on specific dashboard widgets to improve data visualization.
Adds dimension-based formatting rules for custom dashboard coloring
1 detail in Everything
Client Connector — ZDX Module Release Summary (2025) — 2025-12-16
Dec 16, 2025
· release notes
ZDX Module 4.5.0.44 adds hardware ID to device telemetry and IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-12-16
Dec 16, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds GCP BigQuery BigQuery A serverless, cloud-hosted analytical database from Google that runs SQL queries across massive datasets without managing infrastructure, giving cyber tools scalable storage and fast querying over large volumes of log or event data. and Azure Germany North data scanning, new AI Inventory risk filters, on-prem scanner init command, and dozens of new posture policies
Adds data discovery, classification, and posture scanning for GCP BigQuery resources Adds data discovery and classification support for the Azure Germany North region Adds LLM LLM A large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. Safety & Societal Impacts Risk, LLM Security Risk, LLM Reliability Risk, LLM Privacy Risk, Overall LLM Safety Risk, Model Supply Chain Risk, and Open Source License Type filters to Managed Models in AI Inventory Adds Model Supply Chain Risk and Open Source License Type filters to Unmanaged Model (Hugging Face) in AI Inventory Adds Access Type, Supply Chain Risks, and License Type filters for AI Tools & Packages in AI Inventory
+9 more
show less
Adds Model Safety Evaluation Results chart for managed AWS and Azure models in AI Inventory Adds Risk Assessment Results chart for Hugging Face open-source models in AI Inventory Adds Package Risk Assessment Results chart for AI packages in cloud accounts or associated with open-source AI models Changes alert age calculation to start from zero upon generation or reset Adds AWS, Azure, On-Premises, Snowflake, and Databricks posture policies (e.g., 'AWS Bedrock Knowledge Base containing sensitive data can be accessed by IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. users without MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. ', 'Azure storage account containing sensitive file share data is not encrypted with a customer-managed key', 'Snowflake database containing sensitive table data is publicly exposed and can be accessed by users without MFA') Adds single init command for on-premises scanner OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. and VHD images to automate onboarding and initialization Adds support for scanning on-premises unmanaged databases (SQL Server, PostgreSQL, Oracle, MySQL) with the on-premises scanner Adds Logging, Encryption, Public Exposure, Data Retention posture labels for Unmanaged AWS/Azure MongoDB, On-Premises MongoDB, and GCP BigQuery; adds Dormant Identity label for AWS Databricks Adds GCP BigQuery, On-Premises MongoDB Server, Unmanaged AWS/Azure MongoDB Server, and AWS Bedrock Agent to supported data stores for sensitive data scanning
14 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-15
Dec 15, 2025
· release notes
ZPA adds audit log resource types for Microsegmentation ML recommendations and a zGPU icon indicator for Turbo Mode.
Microsegmentation Namespace , Microsegmentation Recommended Resource Tag , Microsegmentation Resource , Microsegmentation Tag Key , Microsegmentation Tag Namespace Hierarchy , and Microsegmentation Tag Value resource types are now added to Microsegmentation ML recommendation audit logs.A zGPU visual indicator appears next to the Turbo Mode command in the Isolation Bar when hardware acceleration is enabled on an isolation profile with Turbo Mode.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-12-15
Dec 15, 2025
· release notes
Zscaler Zero Trust Gateways now support sa-east-1, ca-central-1, eu-central-2, and eu-west-3 regions.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-12-15
Dec 15, 2025
· release notes
ZDX adds Admin Console remediation to run scripted maintenance on Windows devices
Allows importing PowerShell scripts or using predefined scripts to run remediation updates on impacted devices
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-15
Dec 15, 2025
· release notes
ZIA adds original URL mode to isolation profiles, auto-translation for isolation sessions, and a zGPU visual indicator.
Adds Original URL as a configurable option in Isolation Profiles to show the native browser URL during isolation. Enables global automatic local language translation for Isolation sessions based on user browser settings. Displays a zGPU icon in the Isolation Bar when Turbo Mode is enabled and hardware acceleration is active.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-12
Dec 12, 2025
· release notes
ZIA adds Claude/Mistral Gen AI prompt support via new API fields and UI configuration, plus pagination for URL filtering rules.
Adds enableClaudePrompt and enableMistralAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API endpoints to enable Gen AI prompts for Claude and Mistral Extends UI support for Gen AI prompt configuration to Claude and Mistral generative AI applications via Advanced Policy Settings Adds page and pageSize query parameters to the GET /urlFilteringRules endpoint for paginated rule retrieval with defaults when unspecified Exposes GET /ruleLabels/ruleType/{ruleType} endpoint to retrieve rule labels by type and GET urlFilteringRules/count to count URL filtering rules Increases Firewall Insights Rule Name chart limit to 4,000 rules with selectable increments (500, 1,000, 2,000, 4,000) and shows zero-hit rules in bar/table views
+3 more
show less
Adds 48-hour, 3-day, 5-day, and 7-day time filters to the Firewall Overview dashboard for rule hit count analysis Paginates URL Filtering Policy list in UI with 100 rules per page and enables filtering by Rule Label, Name, Order, Description, Action, Location, Group, User, Device, IP Group, URL Categories, and HTTP Header Profile Supports 64 GB RAM RAM Working memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. and 3 AV engines per Virtual Service Edge on VMware ESXi, Azure, GCP, Hyper-V, AWS, and AWS with GWLB for large file scanning
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-11
Dec 11, 2025
· release notes
ZPA Microsegmentation adds ML tag recommendations, Application Catalog, CIDR CIDR A notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. dynamic criteria, and multi-subnet network segments.
Adds Tag Management > Application Catalog view in Microsegmentation to list applications used for ML tag generation Enables Auto-Tagging with ML recommendations for resources based on flow behavior in Microsegmentation Adds CIDR and IP address ranges as dynamic criteria options in Add Resource Group > Criteria > Dynamic Membership > Environment Allows up to 64 LAN IP addresses and subnets per Network segment in VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. for Legacy Apps
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-11
Dec 11, 2025
· release notes
Adds AWS Virtual Service Edge VM creation via Terraform modules across all ZIA clouds.
Create VM Instance using the Virtual Service Edge Amazon Web Services Terraform Modules Create VM Instance using the Virtual Service Edge Amazon Web Services Terraform Modules
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-10
Dec 10, 2025
· release notes
ZIA adds last modified/shared user fields to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights logs and NSS Feeds for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. visibility
Adds Last Modified User and Last Shared User filters, plus Last Shared On column to SaaS Security Insights logs page Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feed Output Format for SaaS Security logs
2 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2025) — 2025-12-09
Dec 9, 2025
· release notes
Zscaler UVM adds configurable audit log exports to S3 with hourly or daily scheduling
Adds automated hourly and daily export of audit logs to external destinations like Amazon S3 buckets
1 detail in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-12-09
Dec 9, 2025
· release notes
Client Connector 4.5.0.508 adds tunnel PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file download and FQDN subdomain bypass options.
Adds the ability to download the forwarding PAC file through the tunnel when in Tunnel mode instead of directly Updates VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass to optionally not bypass subdomains for FQDNs
2 details in Everything
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-12-09
Dec 9, 2025
· release notes
Audit log download and scheduled export to Amazon S3 for the Zscaler AEM platform
Adds audit logs tracking with automated hourly or daily export capability to an external destination such as an Amazon S3 bucket
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-09
Dec 9, 2025
· release notes
ZIA adds Last Modified/Shared User fields to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights logs and NSS feed formats for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. tracing.
Adds Last Modified User and Last Shared User filters to the SaaS Security Insights page Adds Last Modified User , Last Shared User , and Last Shared On columns to the Assets With Incidents view Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feed Output Format
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-08
Dec 8, 2025
· release notes
ZPA adds version profiles for Network Connectors, prepopulated server groups in AI recommendations, and extended log range.
Adds Version Profile configuration to associate a Network Connector with default, previous, newest, or custom releases Updates AI-Powered Recommendations UI to prepopulate server groups and allow multiple group selection when adding application segments Enables selecting a logging activity start date beyond 14 days (limited availability)
3 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2025) — 2025-12-08
Dec 8, 2025
· release notes
New GitHub Repositories connector allows ingesting repo metadata and custom properties.
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-12-08
Dec 8, 2025
· release notes
Zscaler AEM adds GitHub Repositories connector and ServiceNow CMDB CMDB A Configuration Management Database: a repository that stores records of IT assets and the relationships between them, giving cyber tools a single authoritative source for infrastructure context. outegration.
Adds GitHub Repositories connector for limited availability to ingest repository metadata, branch selection, and organization custom properties. Adds ServiceNow CMDB outegration for limited availability to facilitate updates to Configuration Management Database records including adding missing assets.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-12-05
Dec 5, 2025
· release notes
ZDX adds Intermediate ISP incident subtype and ZTTFB/Server Processing Time probe metrics.
Adds Intermediate ISP incident subtype to Incidents Dashboard for performance degradation tracking within or between ISPs. Adds Server Processing Time and Zscaler Time to First Byte (ZTTFB) Web probe metrics to the User Details page. Adds new alert rule criteria fields Server Processing Time and Zscaler Time to First Byte for application monitoring.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-05
Dec 5, 2025
· release notes
ZIA adds enableClaudePrompt and enableMistralAIPrompt API fields for Gen AI prompt categorization in ZIA.
Adds enableClaudePrompt and enableMistralAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model, allowing configuration of generative AI prompts for Claude and Mistral via the /advancedUrlFilterAndCloudAppSettings API. Extends Zscaler's Gen AI prompt configuration capability to cover Claude and Mistral generative AI applications for categorization and storage.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-04
Dec 4, 2025
· release notes
ZPA adds preview capability for VPN for Legacy Apps , enabling Layer 3 IP-based connectivity for legacy apps.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-12-03
Dec 3, 2025
· release notes
ZPA adds Microtenant support for Private Service Edges and updated RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images.
Adds hosting of ZPA Private Service Edges and Private Cloud Controllers within each Microtenant to enhance business continuity. Updates ZPA Private Service Edge OVA images for Nutanix and VMware platforms to support Red Hat Enterprise Linux 9, automated OS security updates, and OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-02
Dec 2, 2025
· release notes
ZIA adds /app_views/{appViewId}/accounts API endpoint and supports Google Workspace OU segregation in Third-Party App Governance
Adds /app_views/{appViewId}/accounts API endpoint to retrieve users' email addresses associated with specific app IDs Adds totalenabledusers field to the /app_views/{appViewId}/apps_extended API response
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-12-01
Dec 1, 2025
· release notes
Adds AWS sublocation scopes (VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint, VPC, Account, Namespace) for ZIA policy lookup and logging.
Supports configuring scope as part of sublocation criteria in the Cloud & Branch Connector Admin Portal to group workload traffic by VPC Endpoint, VPC, Account, or Namespace within an AWS account.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-12-01
Dec 1, 2025
· release notes
ZIA adds Sublocation Scopes for granular AWS Cloud Connector policy targeting via API fields.
subLocScopeEnabled, subLocScope, subLocScopeValues, and subLocAccIds attributes added to Location and LocationLite models in /locations endpoints
1 detail in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-11-26
Nov 26, 2025
· release notes
Client Connector 4.7/4.8 adds OTP OTP One-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. auth support and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. download over tunnel; 4.7+ accepts # in usernames.
Install Zscaler SSL Certificate config now supports installing the latest Root CA and removing existing certs for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. InspectionSupports using one-time passwords (OTPs) for customers with Authentication Service tenants Download forwarding PAC file through the tunnel when in Tunnel mode instead of directly Accepts the hash (#) character in the partner tenant username VPN Gateway Bypass updates to optionally not bypass subdomains for FQDNs
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-11-25
Nov 25, 2025
· release notes
Updated RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 GCP image available for ZPA Private Service Edge.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-11-21
Nov 21, 2025
· release notes
ZPA adds systemd journal log retrieval from the Admin Portal, usage metric notifications for PCCs/Nets, and limited SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. /SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. microtenant creation.
Enables retrieval of systemd journal logs for App Connectors, ZPA Private Service Edges, Private Cloud Controllers, and Network Connectors directly from the ZPA Admin Portal Adds usage metric notifications (Bandwidth, CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. , Disk, File Descriptors, Source Port, System Memory limits) for Private Cloud Controllers and Network Connectors via Notifications and events diagnostics services Supports creation of Microtenants using SAML attributes, SCIM attributes, or SCIM group criteria in Limited Availability
3 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-11-21
Nov 21, 2025
· release notes
Workflow Automation adds custom workflow builder and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident column expansions for Email and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. sources.
Adds drag-and-drop custom workflow creation via the Add Custom Workflow button on the Workflows page Adds Triggered Recipients column to Incidents table for Source DLP type Email Adds External Recipients and Internal Recipients columns to Incidents table for Source DLP type SaaS Security Adds External, Internal, and Triggered Recipients attributes as filter options in the Filters window Expands Incident export CSV file with External, Internal, and Triggered Recipients columns
+1 more
show less
Redesigns Violation Details and Files Policy windows to show Triggered and Non-Triggered Engines and Dictionaries sections
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-21
Nov 21, 2025
· release notes
AWS account/group management APIs and limited-availability JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth added to ZBC
Adds GET /publicCloudInfo, POST /publicCloudInfo, GET /publicCloudInfo/cloudFormationTemplate, GET /publicCloudInfo/count, POST /publicCloudInfo/generateExternalId, GET /publicCloudInfo/lite, GET /publicCloudInfo/supportedRegions, GET /publicCloudInfo/{id}, PUT /publicCloudInfo/{id}, DELETE /publicCloudInfo/{id}, and PUT /publicCloudInfo/{id}/changeState endpoints for AWS account CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. and metadata Adds GET /discoveryService/workloadDiscoverySettings and PUT /discoveryService/{id}/permissions endpoints for workload discovery settings management Adds GET /accountGroups, POST /accountGroups, GET /accountGroups/count, GET /accountGroups/lite, GET /accountGroups/{id}, PUT /accountGroups/{id}, and DELETE /accountGroups/{id} endpoints for AWS account group CRUD Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads, with sessions logged in Web Insights using the JWT user ID
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-21
Nov 21, 2025
· release notes
ZIA adds Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. channels (Clipboard/File Access), IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. PSE/JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth, Enhanced US Driver's License dict, and GitHub SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls.
Adds Application File Access and Clipboard as channels in Endpoint DLP policy rules to detect and block sensitive data at rest and paste operations on Windows endpoints Adds the ability to define multiple removable storage devices mapped to specific users within a single Device Control Removable Storage rule, with CSV bulk import support Introduces configurable Endpoint Data Scan - End User Report for local sensitive data visibility on Windows endpoints Adds granular Endpoint DLP Configurations options: exclude file systems/folders, skip high-volume application files in continuous classification, disable OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. , and per-channel application exclusions Adds Analytics > Endpoint Data Scan > Inventory > Applications page to view installed software, running processes, and libraries on endpoints
+13 more
show less
Adds Analytics > Endpoint Data Scan > Device Investigation page for real-time endpoint health and detected file details Enables Sensitive Information Index Document Match (IDM) via Endpoint DLP context menu for parallel detection against indexed documents (Limited Availability) Adds new predefined DLP dictionaries for Endpoint DLP: CNPJ Number (Brazil), IBAN, National Economic Registry Number (Poland), and Passport Number (Asia) Adds 15-byte prefix/suffix context to Endpoint DLP triggers visible in Incident Receiver, Zscaler Workflow Automation, and Email Notifications Supports Proximity Length field on predefined DLP dictionaries for Endpoint DLP engines when Confidence Score Threshold is High Adds Last Modified User , Last Shared User , and Last Shared On filters/columns in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs for file applications Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feeds Output Format for SaaS Security logs Enhances IPv6 infrastructure to receive traffic directly from remote users via Zscaler Client Connector when Enable IPv6 Resolution for Zscaler Domains is enabled in the Portal Supports IPv6 traffic in Private Service Edge via Zscaler Client Connector or PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files when Enable IPv6 Resolution for Zscaler Domains is enabled Enables JWT authentication for Cloud & Branch Connector workloads, configured on the Advanced Settings page and managed via Authentication Service Admin Portal Adds JWT Auth for Workload field on the Tenant Details page (Tenant > Tenant Details page > Special Settings) in Management Portal for Partners to enable JWT auth for tenants Replaces legacy Driver's License (United States) dictionary with Enhanced US Driver's License dict, exposing individual state sub-dictionaries configurable via Confidence Score Threshold and Proximity Length Increases SSPM controls for GitHub in Advanced SSPM by adding eleven new controls
18 details in Everything
Private Access (ZPA) — Private Cloud Controller Release Summary (2025) — 2025-11-21
Nov 21, 2025
· release notes
Private Cloud Controller 25.49.4 adds redirect users to Private Service Edges in Microtenants
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-19
Nov 19, 2025
· release notes
ZIA adds Gen AI prompt configs for Claude/Mistral, DNS Control EUNs, and MIP labels in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. remediation.
Adds enableClaudePrompt and enableMistralAIPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API to enable Gen AI prompts for Claude and Mistral Adds a new End User Notification (EUN) page option within DNS Control Policy to display blocking notifications hosted by Zscaler Allows applying MIP labels as manual remediation actions for OneDrive and SharePoint incidents in SaaS Security Assets
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-18
Nov 18, 2025
· release notes
Cloud & Branch Connector introduces Sublocation Scopes to group AWS workloads and apply granular ZIA policies.
Adds Sublocation Scopes to Cloud & Branch Connector Admin Portal, allowing grouping of workload traffic into sublocations at VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint, VPC, Account, or Namespace levels in AWS Enables policy lookup distinction for multiple workloads sharing the same source IP address space using Sublocation Scopes
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-18
Nov 18, 2025
· release notes
ZIA adds GitHub SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls, DNS EUN customization, sublocation scopes, and Traffic Capture for NDR NDR Network detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. APIs
GET /trafficCaptureRules, POST /trafficCaptureRules, PUT /trafficCaptureRules/{ruleId}, DELETE /trafficCaptureRules/{ruleId}, GET /trafficCaptureRules/count, GET /trafficCaptureRules/order, and GET /trafficCaptureRules/ruleLabels endpoints added to the Cloud Service API for Traffic Capture policy management.Adds the subLocScopeEnabled, subLocScope, subLocScopeValues, and subLocAccIds attributes to the Location and LocationLite models in the /locations API endpoints to support sublocation scopes. Standalone Traffic Capture policy page added at Policy > Traffic Capture for granular control of triggers, sampling, and connection collection limits. Traffic Capture settings page at Administration > Traffic Capture now allows obfuscation of captured data information and S3 bucket configuration. DNS Control policy now supports a hosted End User Notification (EUN) page with customizable organization name, logo, and message.
+1 more
show less
Administration > Location Management > Locations > Add Sublocation window adds the Scope , Account , Namespace , VPCVPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. , and VPC Endpoint fields for defining sublocation scope types.
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-17
Nov 17, 2025
· release notes
Zscaler Cloud & Branch Connector adds GCP user-defined tags and attributes to security policies.
Supports applying security policies in Google Cloud Platform using user-defined tags and attributes for workloads. Supports applying labels and network tags in GCP as part of workload discovery.
2 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-11-17
Nov 17, 2025
· release notes
Client Connector 4.7 adds Business Continuity, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. forwarding, step-up auth, and FIDO2 FIDO2 The open standard behind passkeys and hardware security keys, where a website checks a signature from the user's device instead of a password. Because the key is bound to the site, phishing pages cannot use it. hardware key support.
reconnectT2OnWake config parameter added to Application & Custom settings for quicker reconnect after sleepAdds Business Continuity support in Zscaler Private Access (ZPA) to maintain app access during cloud availability events Adds IPv6 traffic forwarding from IPv6-only macOS devices to ZIA and ZPA Adds step-up authentication for conditional access to ZIA and ZPA based on dynamic requests Adds authentication with FIDO2-compliant hardware keys via a pop-up browser in Authentication Service
5 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-14
Nov 14, 2025
· release notes
AWS Account and Group API endpoints added; JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication enabled for connector workloads.
Adds GET /publicCloudInfo, POST /publicCloudInfo, and related /discoveryService APIs to manage AWS accounts and groups programmatically Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads via the ZIA Admin Portal
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-14
Nov 14, 2025
· release notes
ZIA adds CC search support, JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth for Connectors, enhanced US DL DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dicts, and new CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. REST endpoints
Adds Enable Creative Commons Search Results option to Policy > URL & Cloud App Control > Advanced Policy Settings to filter search results by license Exposes two new API endpoints for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security: GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} to retrieve scan configuration and validation status Adds JWT Auth for Workload field in Management Portal for Partners > Tenant > Tenant Details page > Special Settings to enable JWT auth for tenant connectors Introduces Enhanced Driver's License (United States) predefined DLP dictionary with individually configurable state sub-dictionaries accessible via Administration > DLP Dictionaries & Engines
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-11-13
Nov 13, 2025
· release notes
Agent Manager Status and Version now viewable in the Agent table for Microsegmentation.
Agent Manager Status and Agent Manager Version fields added to the Agent tableApp Connector updated Red Hat Enterprise Linux 9 images deployed for GCP and Azure OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment support enabled for App Connectors on RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9
3 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-11-13
Nov 13, 2025
· release notes
Zscaler Client Connector 4.2 adds Z-Tunnel 2.0 bypass options, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. exclusions, and health metrics collection.
Adds two new Z-Tunnel 2.0 protocol bypass options: Redirect Web Traffic to Zscaler Client Connector Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic. Adds ZIA posture profile device trust levels configuration capability that displays in the Zscaler Client Connector Registered Device Details page. Enables configuration of early reauthentication notification for end users before ZPA applications expire. Adds IPv6 inclusions and exclusions support for Z-Tunnel 2.0. Supports using a preferred port to enable Zscaler Client Connector to ZIA communication.
+6 more
show less
Increases supported ZPA Application Segments to up to 50K. Adds ability to exclude traffic from being sent to specific DNS servers. Enables configuration of fallback options on Z-Tunnel 2.0 establishment failure. Enhances strict enforcement feature to block all ports and protocols. Supports DNS SRV SRV A DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses. (DNS service record) app scaling for up to 50,000 ZPA apps. Adds support for the collection of Health Metrics on devices to allow for diagnostics and to proactively identify issues.
11 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-12
Nov 12, 2025
· release notes
ZIA adds DNS End User Notifications and MIP label remediation for OneDrive/SharePoint
Adds DNS End User Notification capability in DNS Control Policy to show a hosted notification page with custom logo and message when access is blocked. Adds option to apply a MIP Label as a manual remediation action for file sharing applications OneDrive and SharePoint from the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Assets with Incidents page.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-11
Nov 11, 2025
· release notes
Zscaler Cloud & Branch Connector adds Sublocation Scopes to group AWS workloads (Limited Availability)
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-11
Nov 11, 2025
· release notes
ZIA adds MIP label remediation for SharePoint and sublocation scopes for AWS workloads
Apply MIP labels as manual remediation actions for OneDrive and SharePoint in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Assets Define sublocation scopes (Scope, Account, Namespace, VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. , VPC Endpoint) to map AWS Cloud Connector workload traffic
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-10
Nov 10, 2025
· release notes
Cloud & Branch Connector adds Local traffic forwarding for east-west, internet ingress, and AWS Direct Connect paths.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-10
Nov 10, 2025
· release notes
ZIA adds Last Modified/Shared user tracking in Insights Logs and NSS Feeds for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incidents.
Adds Last Modified User and Last Shared User filters to the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights page Adds Last Modified User , Last Shared User , and Last Shared On columns to the Assets With Incidents table Adds %s{last_edit_user}, %s{last_share_user}, and %s{last_shared_on} fields to NSS Feeds SaaS Security log output
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-11-10
Nov 10, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds data posture policies for multiple cloud/data platforms, new scan support for Azure File Shares and Hyper-V, and AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. condition operator updates
Adds Azure File Shares scanning support over SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. and NFS to discover and classify sensitive data Adds AWS Databricks data collection and posture scanning capability Adds NotPrincipal, ArnNotLike, and IfExists AWS IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. condition operators for managing access to scan data Adds Hyper-V deployment mode for the on-premises scanner Adds NFS protocol support for adding on-premises file servers in addition to SMB
+1 more
show less
Renames Over-Privileged Access posture label to Privileged Access and adds new posture labels for AWS Databricks, Azure OpenAI, and Azure AI Foundry Hub resource types
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The posture label Over-Privileged Access is renamed to Privileged Access
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-11-07
Nov 7, 2025
· release notes
New AWS account APIs and JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication for Cloud & Branch Connector.
Adds API endpoints GET /publicCloudInfo, POST /publicCloudInfo, GET /publicCloudInfo/cloudFormationTemplate, GET /publicCloudInfo/count, POST /publicCloudInfo/generateExternalId, GET /publicCloudInfo/lite, GET /publicCloudInfo/supportedRegions, GET /publicCloudInfo/{id}, PUT /publicCloudInfo/{id}, DELETE /publicCloudInfo/{id}, PUT /publicCloudInfo/{id}/changeState for AWS account management. Adds API endpoints GET /discoveryService/workloadDiscoverySettings and PUT /discoveryService/{id}/permissions for workload discovery settings. Adds API endpoints GET /accountGroups, POST /accountGroups, GET /accountGroups/count, GET /accountGroups/lite, GET /accountGroups/{id}, PUT /accountGroups/{id}, DELETE /accountGroups/{id} for AWS account group management. Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads, logged in Web Insights with the user ID from the JWT.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-07
Nov 7, 2025
· release notes
Adds JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth for ZIA connectors and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan API endpoints.
└──▷ USE IT
Query the scan status of a SaaS tenant programmatically.
api
copy
GET /casbTenant/validate/status/{tenantId}
Enables JWT Authentication for Zscaler Cloud & Branch Connector workloads to replace legacy methods Adds JWT Auth for Workload field on the Tenant Details page in Management Portal for Partners to enable JWT per tenant Exposes GET /casbTenant/scanInfo endpoint to retrieve SaaS Security Scan Configuration and validation status
3 details in Everything
Zero Trust Branch — Release Upgrade Summary (2025) — 2025-11-07
Nov 7, 2025
· release notes
Zero Trust Branch 8.0.7 adds temporary remote support access and renames the root FS upgrade method in the UI
Adds Remote Support Access to the user profile drop-down menu for granting Zscaler Support personnel time-bound, audited super admin-level access
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! The Use Legacy Method to Change Version option is renamed to Use Root FS Upgrade Method in the UI.
Workflow Automation — Release Upgrade Summary (2025) — 2025-11-06
Nov 6, 2025
· release notes
Zscaler Workflow Automation adds Data Privacy Settings section in Add Admin Assignment with new Hide Evidence/Trigger Data options
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-06
Nov 6, 2025
· release notes
ZIA adds Virtual Service Edge Azure Terraform Modules to automate VM provisioning
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-11-06
Nov 6, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds posture policies for AWS/Azure/GCP/Snowflake/Oracle/Databricks, scan support for Azure File Shares/Hyper-V/NFS and new IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. condition operators.
Adds data posture policies for AWS, Azure, GCP, Snowflake, On-Premises Oracle, and Databricks to detect sensitive data exposure vulnerabilities Adds scanning support for Azure File Shares over SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. and NFS protocols Adds discovery and classification capabilities for AWS Databricks workspaces and accounts Supports NotPrincipal, ArnNotLike, and IfExists AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. condition operators in scan configurations Adds Hyper-V deployment mode for the on-premises scanner
+1 more
show less
Adds NFS protocol support for on-premises file servers alongside existing SMB
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-05
Nov 5, 2025
· release notes
ZIA adds Enhanced US Driver's License DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary with per-state sub-dictionary support
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-11-04
Nov 4, 2025
· release notes
ZPA Notifications service adds event triggers for Network Connectors, enabling alerts on connector lifecycle and health states.
Adds support for configuring notifications on specific events for Private Access Network Connectors, including Last Component Disconnected , Upgrade Complete , Upgrade Failed , Outdated Component Manager Version , Provisioning Key Usage Exceeded , Enrollment Completed , Enrollment Failed , Enrollment Certificate Expired , Control Connection Disconnected , and CPU Starvation . Expands the Notifications service capability to include Network Connector event monitoring for both the private.zscaler.com and zpatwo.net cloud platforms.
2 details in Everything
Deception — Release Upgrade Summary (2025) — 2025-11-04
Nov 4, 2025
· release notes
Zscaler Deception adds AI-powered decoy recommendations, agent error logs, and FreeBSD 14.3 upgrade.
Adds AI-Powered Recommendations for Threat Intelligence Decoys to generate TI decoy recommendations with preselected hostnames and datasets Adds an icon to access error logs for endpoint agents in the Admin Portal UI Upgrades Decoy Connectors and Aggregators operating system to FreeBSD 14.3 Adds a Client Connector Version column on the Agents page (Endpoint Settings > Agents) Updates Linux file decoy hiding convention to use dot (.) as a prefix before the filename
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Keychain-based lures in macOS landmine policies are no longer supported
Client Connector — Client Connector App Release Summary (2025) — 2025-11-04
Nov 4, 2025
· release notes
Zscaler Client Connector 4.4 for iOS adds Device Groups, iCloud Private Relay controls, SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration, and higher ZPA segment limits
Supports Device Groups and the assignment of service entitlements based on device posture.Includes support to show the Serial Number under Enrolled Device details.Includes support for Disabling iCloud Private Relay in App Profiles.Includes support for up to 50k ZPA Application Segments.Supports Authentication Service integration for Single-Sign On (SSO), Device Posture, Authentication Service as IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. , Strict Enforcement, and Multi-cloud selection.
5 details in Everything
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-11-04
Nov 4, 2025
· release notes
The release introduces a new dashboard feature within the Zscaler SecOps SecOps The practice of merging security and IT operations teams so that threat detection, response, and infrastructure management share the same workflows, giving cyber tools a single pipeline from alert to remediation. platform.
Adds the Violation Tickets Dashboard in the Zscaler Security Operations (SecOps) platform for visibility into violation ticket identification, management, and resolution
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-11-03
Nov 3, 2025
· release notes
ZIA custom views in 3rd-Party App Governance now include current tenant selection from global platform filters
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-31
Oct 31, 2025
· release notes
ZPA App Connector OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images updated for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 to support OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. enrollment and automated OS security updates.
Adds OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 enrollment support to ZPA App Connector on Red Hat Enterprise Linux 9 via updated OVA images for Nutanix AHV AHV Acropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. and VMware Updates App Connector OVA images on Red Hat Enterprise Linux 9 to support automated OS security updates
2 details in Everything
Authentication Service — Release Upgrade Summary (2025) — 2025-10-31
Oct 31, 2025
· release notes
Authentication Service supports common domains for multiple tenants with OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. flow
Adds support for using the same domain across multiple Authentication Service tenants Enables tenant selection via a drop-down menu during login for users on shared domains Supports OpenID Connect OpenID Connect OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) flow redirection for Experience Center, Breach Predictor, EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. , and DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-31
Oct 31, 2025
· release notes
ZIA adds Creative Commons search filter and End User Notifications for Zscaler Client Connector firewall/DNS/IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. policies.
Adds the Enable Creative Commons Search Results option to the Policy > URL & Cloud App Control > Advanced Policy Settings page in the admin portal. Enables End User Notifications (EUNs) for ZIA Firewall Filtering, DNS Control, and IPS Control policies when using Zscaler Client Connector version 4.8 or later on Windows. Adds a customizable EUN message selection field to individual firewall, DNS, and IPS policy rules in the ZIA Admin Portal. Adds an Adaptive Access Profile column and filter to Web Insights Logs for tracking adaptive access decisions.
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-30
Oct 30, 2025
· release notes
New ZPA API endpoints for application management, OAuth2 OAuth2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. auth, and device posture failure notifications
Adds Device Posture Profile Failure Notification to send default or custom alerts when a device fails a posture check Adds multiple new GET/POST/PUT/DELETE endpoints under /mgmtconfig/v1/admin/customers/{customerId}/application/ for application management, including export and validation
2 details in Everything
Client Connector — ZDX Module Release Summary (2025) — 2025-10-30
Oct 30, 2025
· release notes
ZDX Module 4.6.2.7 adds monitoring for system health issues and expands Z-Tunnel HTTP metrics.
Expands HTTP_CONNECT_TIMING metrics in Zscaler Tunnel (Z-Tunnel) 1.0 mode for Web probes
1 detail in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-10-30
Oct 30, 2025
· release notes
Zscaler Client Connector 4.8 adds Z-Tunnel 2.0 support, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. forwarding, OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. pre-auth, and per-profile packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. .
Adds the ability to download, validate, and cache the CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. used when performing the CRL check for the Client Certificate device posture check in certain fallback scenarios Supports using one-time passwords (OTPs) for customers with Authentication Service tenants Supports IPv6 traffic forwarding from IPv6-only Windows devices to Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) Adds support to install the latest Zscaler Root CA Certificate if Install Zscaler SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Certificate is enabled and remove the existing certificate for SSL Inspection Supports identifying the system proxy manually instead of using the default Microsoft Windows APIs
+26 more
show less
Adds an app profile option to define the default language for the Zscaler Client Connector app and an in-app option that allows users to change the language as needed Adds an install option that can be used to prevent Zscaler Client Connector from starting automatically after installation Supports enabling and disabling ZIA and Digital Experience (ZDX) remotely via CLI Supports enabling local packet capture on an app profile in addition to the existing global packet capture enablement Enhances the Packet Capture on the More window in the app to provide separate filter options for adapter packets and Lightweight Filter (LWF) driver packets Supports automatically starting packet captures packet captures A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for specific scenarios such as tunnel failures and health checks Updates Zscaler Client Connector to always use the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile Updates captive portal detection to make asynchronous requests to reduce latency Supports controlling how End User Notifications (EUNs) from ZIA are displayed for users Expands support for adding additional user login domains in the Additional IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Domains field, making it available to all customers, not just those using Imprivata Supports using OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 to authenticate for Authentication Service users before the machine tunnel starts, requiring end users to use an external device Updates Zscaler Client Connector to always use the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile Expands HTTP_CONNECT_TIMING metrics for Web probes, improving visibility into TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. handshake and HTTP connection times between Z-Tunnel 1.0 and the Service Edge Supports a new traffic forwarding action for ZIA Disaster Recovery so you can forward traffic using Zscaler Tunnel (Z-Tunnel) 2.0 Supports testing Business Continuity mode with a group of users Supports the Adaptive Access Engine used to receive user-related context signals from Microsoft Defender Supports automatically switching to a TLS connection if the Z-Tunnel 2.0 DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. connection becomes unstable Supports displaying a customizable notification to end users who are blocked from a ZPA app due to a failed device posture Enables Zscaler Client Connector to steer traffic and manage endpoint firewall rules based on the user’s network type (e.g., On-Trusted or Off-Trusted) Supports automatic ZPA reauthentication settings on the app profile that can override the global setting and can be applied based on a user’s network environment (e.g, On-Trusted or Off-Trusted) Supports using location services on the user’s device to find the nearest data center Supports preventing automatic reauthentication to ZPA while a user’s device is locked Supports a device posture check for specific Zscaler Client Connector versions Supports monitoring system proxy settings and re-caching them if Zscaler Client Connector detects changes Updates Zscaler Client Connector to run Npcap in non-promiscuous mode (instead of promiscuous mode) when performing packet captures Supports creating and assigning notification templates per app profile to allow more granularity in which users see different notifications
31 details in Everything
└──▷ BREAKING ON UPGRADE
! Zscaler Client Connector version 4.8 always uses the packet-based filter driver when in Tunnel mode regardless of the Tunnel Driver Type setting in a user’s forwarding profile.
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-10-29
Oct 29, 2025
· release notes
Adds Jira integration for External Attack Surface Management findings to create and sync tickets from the Admin Portal.
Adds Jira Integration for EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. , allowing admins to connect a Jira instance to individual EASM organizations. Enables creation of Jira tickets for EASM findings with automatic synchronization between the two applications.
2 details in Everything
Zero Trust Branch — Release Upgrade Summary (2025) — 2025-10-28
Oct 28, 2025
· release notes
Zscaler ZTB 8.0.6 introduces Gateway Version Manager, separate WAN/private DNS, static route sharing over RT, and single-VLAN DNS source.
Adds Gateway Version Manager panel for per-gateway upgrade operations, version download (up to 3), activation, and default designation with status observation (Initializing, Restarting, Standalone, Active, Standby). Adds ability to designate a single VLAN in LAN as the source for DNS proxy requests over Routed Tunnels via Use for DNS Proxy on the VLANs tab. Enables sharing static routes over Routed Tunnels via BGP BGP A routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. by enabling Share Over RT on static routes, advertising target subnets to the hub and SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. fabric. Allows separate configuration of WAN and Private DNS servers for a site in DNS settings, populating distinct system groups (e.g., System-Private-DNS-Servers-Group ) for different query resolution paths.
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-10-27
Oct 27, 2025
· release notes
Zscaler Cloud & Branch Connector adds limited availability AWS sublocation scopes to group workloads by VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. Endpoint, VPC, Account, or Namespace
Adds support for Sublocation Scopes to group Cloud Connector workload traffic into sublocations within an AWS account.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-27
Oct 27, 2025
· release notes
ZIA adds Sublocation Scopes for AWS Cloud Connector workloads via new UI fields and API attributes
Adds Scope , Account , Namespace , VPCVPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. , and VPC Endpoint fields to the Administration > Location Management > Locations > Add Sublocation window to map workload traffic for granular policy application. Updates /locations cloud service API endpoints (models Location and LocationLite) with new attributes: subLocScopeEnabled, subLocScope, subLocScopeValues, and subLocAccIds.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-10-24
Oct 24, 2025
· release notes
Adds AWS endpoint APIs for account/group management and JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. auth support for GCP tag-based policies.
Adds programmatic access to AWS accounts and groups via GET/POST/PUT/DELETE APIs under /publicCloudInfo and /accountGroups. Enables JSON Web Token (JWT) authentication for Zscaler Cloud & Branch Connector workloads. Supports applying security policies in Google Cloud Platform using user-defined tags, attributes, labels, and network tags.
3 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-10-24
Oct 24, 2025
· release notes
Client Connector 4.5.0.498 for Windows adds automated Zscaler Root CA cert management during SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection installation.
Adds support to install the latest Zscaler Root CA Certificate if Install Zscaler SSL Certificate is enabled and to remove the existing certificate for SSL Inspection.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-10-24
Oct 24, 2025
· release notes
ZDX adds EOS/EOL view on Software Inventory page and new Network Health widgets to Network Intelligence Dashboard
Adds End-of-Support (EOS) and End-of-Life (EOL) information display on the Software Inventory page Adds Network Anomalies for Last 14 Days widget to the Network Intelligence Dashboard Adds Top 5 Cities Sorted by User Count widget to the Network Intelligence Dashboard Adds Top 5 High-Latency ASNs widget to the Network Intelligence Dashboard
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-24
Oct 24, 2025
· release notes
ZIA adds JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. authentication for Zia Cloud & Branch Connector workloads and enhances US Driver's License DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries with state-level sub-dictionaries.
Adds JWT Authentication support for Cloud & Branch Connector workloads, configurable via Advanced Settings page exemptions and managed via Authentication Service Admin Portal token validators Adds Enhanced Driver's License (United States) predefined DLP dictionary with individually configurable state sub-dictionaries (50 states + DC) accessible via DLP Dictionaries & Engines page Adds GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} endpoints to retrieve SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan Configuration and validation status Adds Adaptive Access Profile filter and column to Web Insights Logs for tracking adaptive access decisions
4 details in Everything
Zscaler Cellular — Release Upgrade Summary (2025) — 2025-10-24
Oct 24, 2025
· release notes
Zscaler Cellular adds admin portal support to view, assign, activate, and deactivate eSIMs.
Adds the ability to manage eSIMs (embedded SIMs) alongside physical SIM cards directly from the Zscaler Cellular Admin Portal Displays eSIMs on the SIMs page with a Form Factor column identifying them as eSIMs Allows administrators to assign, activate, or deactivate eSIMs through the portal interface
3 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-10-23
Oct 23, 2025
· release notes
Incidents page gains External Collaborators Groups, File Link Expiry, and File Modified/Shared columns for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security source DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incidents
Adds External Collaborators Groups, File Modified By, and File Shared By attributes as new filter options in the Filters window on the Incidents page.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-17
Oct 17, 2025
· release notes
ZIA adds CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. tenant scan APIs and JWT JWT An open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. workload auth; Adaptive Access in limited availability.
Adds GET /casbTenant/scanInfo API endpoint to retrieve SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Scan Configuration Adds GET /casbTenant/validate/status/{tenantId} API endpoint to validate SaaS application tenant status Adds support for Adaptive Access Engine in Experience Center Limited Availability
3 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-10-15
Oct 15, 2025
· release notes
Client Connector 4.7.0.113 for Windows updates packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. mode and firewall rule lifecycle; fixes numerous reliability issues.
Updates Zscaler Client Connector to run Npcap in non-promiscuous mode (instead of promiscuous mode) when performing packet captures packet captures A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. . Updates a previous change to keep a Zscaler Client Connector firewall rule active from starting to stopping the app to also delete the rule when exiting the app and add the rule when restarting the app.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-15
Oct 15, 2025
· release notes
ZIA adds Automatic Session Restore for isolation timeouts and shows original URLs in the isolation UI.
The isolation UI now displays the original website URL instead of the intermediate isolation landing page.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-13
Oct 13, 2025
· release notes
Adds filtered report downloads for application segments on the Application and User Group Relationships insights page.
Workflow Automation — Release Upgrade Summary (2025) — 2025-10-13
Oct 13, 2025
· release notes
Workflow Automation adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. attributes and new time range filters for incidents.
Adds Current Tag Name , Is Copilot Accessible , External Groups Collaborators , Internal Groups Collaborators , Document Sub Type , File Line Expiry , File Modified By , File Shared At , and File Shared By as mapping properties for Incident Group Mappings and Workflow Mappings of Source DLP type SaaS Security. Adds Current Hour , Last Hour , Last 2 Hours , Last 6 Hours , and Last 12 Hours options to the time range selector on the Incidents page and Incident Analytics dashboard. Adds a clickable Username/User Email link on the Incidents page and Incident Analytics dashboard that filters incidents by that specific user.
3 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-10-10
Oct 10, 2025
· release notes
Client Connector 4.0 adds Z-Tunnel 2.0 support, hybrid forwarding, and early reauth notifications for Android/ChromeOS
Adds support for Zscaler Tunnel (Z-Tunnel) 2.0 in App Profiles. Enables admins to configure an early reauthentication notification for end users before ZPA applications expire. Displays the tunnel version for Zscaler Internet Access (ZIA) in Zscaler Client Connector. Adds a visual notification of users’ authentication status on the Zscaler Client Connector icon in the Android status bar or Chromebook shelf.
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-10-10
Oct 10, 2025
· release notes
ZDX introduces admin scoping capabilities to limit the privileges of Authentication Service admins.
Authentication Service — Release Upgrade Summary (2025) — 2025-10-10
Oct 10, 2025
· release notes
Admin Portal adds SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. certificate expiration banners, email reminders, and multiple IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. cert upload support
Adds a banner in the Admin Portal and visual indicators on the External Identities page when SAML certificates (IdP Certificate or SAML Request Signing and Decryption Certificate) are expiring within 90 days or have expired. Enables weekly email reminders for the last 90 days before SAML certificate expiration, plus two post-expiration reminder emails to administrators.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-10-10
Oct 10, 2025
· release notes
ZIA adds API endpoints for IP Groups, NSS download, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scan status; Adaptive Access Engine in limited availability.
Adds override boolean query parameter to the PUT /ipDestinationGroups/{ipGroupId} endpoint to override IPs. Adds GET /nssDownload/{nssId} endpoint to download NSS virtual appliance information by server ID. Adds GET /casbTenant/scanInfo and GET /casbTenant/validate/status/{tenantId} endpoints for SaaS Security scan configuration and validation status. Adds Adaptive Access Engine support for URL Filtering and Cloud App Control policies under Limited Availability. Adds Adaptive Access Profile filter and column to Web Insights Logs.
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-09
Oct 9, 2025
· release notes
ZPA Network Connector gains GCP prebuilt image support for upcoming VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. redundancy.
Adds a new Google Cloud Platform (GCP) prebuilt image for the ZPA Network Connector. Includes preliminary support for upcoming VPN redundancy features in the GCP Network Connector.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-08
Oct 8, 2025
· release notes
ZPA Private Access adds global BGP BGP A routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. configuration, redundancy monitoring, and new CLI capabilities for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Service Edges and Network Connectors.
Adds global BGP configuration options to VPN Service Edges and Network Connectors , including BGP Timers and bidirectional forwarding detection (BFD) session failure detection. Introduces a new BGP Peers page in the UI to view routing, peers, and connection information for Network Connectors per VPN Service Edge. Adds a Network Connector Throughput chart on the Network Connectors Dashboard to monitor throughput and capacity planning. Enables execution of diagnostic commands with VPN sessions for VPN Service Edges , Network Connectors , and Network Connector groups on the VPN Support Information page . Adds a Redundant Mode option viewable by expanding a group on the Network Connector Groups page or adding it as a column on the VPN Service Edges page .
+1 more
show less
Allows setting outbound VPN tunnel gateway ports for VPN Service Edges to use a range from 51820 to 53000.
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-06
Oct 6, 2025
· release notes
ZPA microsegmentation adds agent group criteria, timestamp filters, and app protection API insights
Adds API Insight filter on AppProtection Diagnostics page for deeper API log analysis in Limited Availability Adds Upgrade Now button in Actions column of Agents and Agent Groups pages for manual agent upgrades Adds Initial Target Version field in Configuring Agent Groups to set automatic agent versioning on startup Adds customizable timestamp selector tool for Analytics Logs tables (Flow Logs, Agent Telemetry, Agent Connection Status Logs, Event Logs) Adds Agent Group as Dynamic Criteria option under new ZMS category in Resource Group configuration
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-03
Oct 3, 2025
· release notes
ZPA adds Private Cloud Controller backup scheduling, remote support sessions, and specific BC notifications.
Adds scheduled backup of up to 100 configuration and policy copies for Private Cloud Controllers, restorable via script Enables creation of remote troubleshooting sessions for Private Cloud Controllers from the ZPA Admin Portal Support Information page Extends Notifications Service to include events for Private Cloud Controllers: Control Connection Disconnected, CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. Starvation, Enrollment Completed, Invalid System Listen IP Configuration, Last Component Disconnected, Outdated Component Manager Version, Provisioning Key Utilization Exceeded Limit, Upgrade Complete, and Upgrade Failed Adds Force Business Continuity Mode toggle when editing a Private Cloud to manually override mode for Controllers, Edges, and Connectors Adds Private Service Edge groups dedicated to Business Continuity or Disaster Recovery
5 details in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-10-03
Oct 3, 2025
· release notes
Client Connector 4.5 adds named notification templates, per-app local packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. , location-based firewall steering, and new profile management APIs.
notification_template configuration in app profiles for consolidated end-user notificationsPer-app local_packet_capture enablement option in App Profiles alongside global setting Traffic steering and endpoint firewall rule management based on user’s network type (On-Trusted/Off-Trusted) via Location-Based Policies New programmatic API endpoints for managing application profiles, process-based applications, predefined IP-based applications, and custom IP-based applications Forwarding profile option to automatically switch from Z-Tunnel 2.0 DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. to TLS when connection becomes unstable
+3 more
show less
App profile setting to disable iCloud Private Relay Device posture check capability for specific Zscaler Client Connector versions Automatic ZPA reauthentication settings at the app profile level with network environment (On-Trusted/Off-Trusted) override
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-10-01
Oct 1, 2025
· release notes
ZPA Private Access introduces UI-based diagnostic filters and updates IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration lifecycle for Authentication Service migration.
└──▷ BREAKING ON UPGRADE
! Disabled admin IdP configurations migrated to Authentication Service are permanently deleted after 30 days.
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-09-30
Sep 30, 2025
· release notes
EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. API adds programmatic access via OneAPI with new endpoints for assets and certificates
Adds programmatic access to External Attack Surface Management features via the Zscaler OneAPI using OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authorization. Adds GET /organizations, GET /organizations/:orgId/findings, GET /organizations/:orgId/findings/:findingId/details, GET /organizations/:orgId/findings/:findingId/evidence, GET /organizations/:orgId/findings/:findingId/scan-output, GET /organizations/:orgId/lookalike-domains, and GET /organizations/:orgId/lookalike-domains/:lookalikeRaw/details endpoints for retrieving EASM organizations, findings, lookalike domains, and associated evidence. Adds new API endpoints GET /{orgId}/assets, GET /{orgId}/assets/{assetId}/services, GET /{orgId}/assets/{assetId}/technologies, and GET /{orgId}/assets/{assetId}/certificates to retrieve discovered assets, their running services, technologies, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS certificates.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-30
Sep 30, 2025
· release notes
ZIA adds custom file types for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and File Type Control policies with new API endpoints and NSS log filters
Adds GET /fileTypeCategories, GET/POST/PUT/DELETE /customFileTypes and GET /customFileTypes/count API endpoints to manage custom file types programmatically Replaces fileTypes attribute with fileTypeCategories in /webDlpRules and /fileTypeRules endpoints to support both predefined and custom file types by ID, name, and category Adds customDownloadFiletype and customUploadFiletype attributes to the ZmanageNssFeed model in /nssFeeds for filtering NSS logs by custom file types Adds Download User-Defined File Type and Upload User-Defined File Type filters and columns to Web Insights Logs Enables creation of custom file types for use in Data Loss Prevention (DLP) and File Type Control policies
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-29
Sep 29, 2025
· release notes
Adds scheduled update windows for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Service Edges to avoid unplanned reboot interruptions.
Enables scheduling software updates for new VPN Service Edges during the initial creation flow. Allows editing the update day and time for existing VPN Service Edges via the Edit VPN Service Edge drawer. Displays a login banner in ZPA Admin Portal prompting administrators to schedule updates, with Sunday 2:00 AM UTC as the fallback default. Applies scheduled update logic to both private.zscaler.com and zpatwo.net cloud platforms.
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-09-26
Sep 26, 2025
· release notes
Adds REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints to retrieve and delete Cloud & Branch Connector VMs by instance ID.
Adds GET /ecVm/uuid/{vmInstanceId} endpoint to retrieve detailed information about a Cloud & Branch Connector VM using its public cloud instance ID Adds DELETE /ecVm/uuid/{vmInstanceId} endpoint to delete a Cloud & Branch Connector VM using its public cloud instance ID
2 details in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-09-26
Sep 26, 2025
· release notes
Zscaler Business Insights (zscaleranalytics.net) allows scheduling new Workplace Reports with a Daily frequency.
Client Connector — Release Upgrade Summary (2025) — 2025-09-26
Sep 26, 2025
· release notes
Zscaler Client Connector Portal 4.5 adds named app profile options, new API endpoints, and telemetry controls
└──▷ HOW TO FIND IT
Use new API endpoints to programmatically manage app and forwarding profiles
📍 API & Developer Reference Guide
Enable telemetry control globally and per-app in App Supportability settings
📍 Enabling Zscaler Client Connector Telemetry
Adds notification template settings consolidated into end user notification configuration for per-app profile assignment Adds manual system proxy identification option on Windows to bypass default Microsoft APIs Enforces HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. prefix for Default PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URLs with no HTTP fallback in forwarding profiles Adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. machine tunnel authentication requiring external device verification before startup Adds Policy Based Access (All Ports) option for ZIA Disaster Recovery using Z-Tunnel 2.0
+19 more
show less
Adds automatic packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. start on Windows for tunnel failures and health checks in App Profiles Removes Imprivata integration requirement for Additional IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Domains option Adds monitoring and re-caching of system proxy settings when changes are detected Enables traffic steering and endpoint firewall rule management based on network type (On-Trusted/Off-Trusted) Adds customizable blocked notification for ZPA app failures due to device posture per app profile Adds location service option to find nearest data center via user device services Adds default language selection for the Zscaler Client Connector app in App Profiles Adds local packet capture enablement to App Profiles alongside global settings Adds device posture check for specific Zscaler Client Connector versions Adds option to disable iCloud Private Relay in App Profiles Adds automatic ZPA reauthentication settings in app profile overriding global settings based on network environment Adds password requirement and generation options when disabling ZIA and ZDX remotely via CLI Updates Registered Devices tab to include devices for Authentication Service tenants Adds Business Continuity mode testing option for user groups Adds TLS connection auto-switch if Z-Tunnel 2.0 DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. becomes unstable in forwarding profiles Updates Browser-Based Authentication field on macOS to Authentication Browser Type drop-down with WebAuthn WebAuthn A web standard that lets a browser prove possession of a passkey or hardware key to a website. It is the browser-facing part of FIDO2 sign-in. Popup Browser option Adds global App Supportability setting to enable or disable Zscaler Client Connector Telemetry Supports changing Registered Devices column calculation basis from Unique-ID to Hardware Fingerprint Adds control for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass inclusion of FQDN subdomains for Z-Tunnel 1.0 and Tunnel with Local Proxy
24 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-09-26
Sep 26, 2025
· release notes
ZDX adds Device Events Reports and a Device Health dashboard for analyzing crashes and hardware profiling
Adds Device Events Reports to the ZDX Admin Portal for viewing aggregated system and software crash insights Adds a new Device Health dashboard providing organization-wide views of struggling devices with real-time hardware analysis
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-26
Sep 26, 2025
· release notes
ZIA adds Adaptive Access Engine, custom file types with API, NSS doc subtype fields, SafeSearch app control, and new Docusign/Copilot SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support.
Adds Adaptive Access Profile filter and column to Web Insights Logs for tracking adaptive access decisions. New REST endpoints (GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, DELETE /customFileTypes/{id}, GET /customFileTypes/count) for managing custom file types via API. Supports UTF-8 BOM BOM A Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. , UTF-16 LE, and UTF-16 BE in File Type Control and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies. Adds safeSearchApps field to AdvancedUrlFilteringCloudAppOptions model on the /advancedUrlFilterAndCloudAppSettings endpoint for granular SafeSearch control. Adds %s{upload_doc_sub_type} (web logs) and %s{upload_doc_subtype} (SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. feeds) fields to NSS Feed Output Format for document subtype logging.
+3 more
show less
Supports Microsoft Copilot and Docusign as new SaaS application tenants for Advanced SSPM scans. Adds No. of Transactions column to Cloud Applications table in the Shadow IT Report. Supports specifying quarantine locations for Google Drive, OneDrive, and SharePoint via Admin Quarantine action in Data at Rest Scanning policies.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! The fileTypes attribute in /webDlpRules and /fileTypeRules endpoints is replaced with the fileTypeCategories attribute; API configurations must be updated to use the new attribute.
Workflow Automation — Release Upgrade Summary (2025) — 2025-09-25
Sep 25, 2025
· release notes
Workflow Automation adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security incident attributes, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. -to-GCP integration, and sort-ordered CSV export.
Adds a Channel column to the Incidents table and a corresponding filter for Source DLP type Endpoint incidents Adds File Shared By, File Shared At, File Modified By, and File Link Expiry attributes to Violation Details for Source DLP type SaaS Security incidents Enables sorting the Incidents table before exporting to CSV so the file respects the on-screen order Adds support for Data Loss Prevention (DLP) application integration with Google Cloud Platform (GCP)
4 details in Everything
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-09-25
Sep 25, 2025
· release notes
New OS End of Life dashboard provides visibility into assets with EOL/EOS operating systems.
Adds the OS End of Life dashboard to view summary tiles, charts, and tables for assets running operating systems that have reached or are approaching End-of-Life (EOL) or End-of-Support (EOS) status.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-25
Sep 25, 2025
· release notes
ZIA adds Subdocument Type filters/columns to Insights Logs and %s{upload_doc_sub_type} field to NSS feed outputs for Snowflake SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. controls.
Adds the Subdocument Type filter and column to Web Insights Logs and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs pages in the ZIA Admin Portal to capture document subtypes Adds the %s{upload_doc_sub_type} field to NSS Feed Output Format for web logs to log uploaded document subtypes Adds the %s{upload_doc_subtype} field to NSS Feed Output Format for SaaS Security feeds configured for file applications to log downloaded document subtypes Increases Advanced SSPM coverage with 46 new Snowflake controls
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-09-25
Sep 25, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI Inventory, new Data Posture Policies for AWS/Azure/Snowflake/On-Prem, scan rules, saved views, and on-prem file server scanning.
Adds the AI Inventory dedicated to inventorying and managing AI/ML resources in the cloud. Adds new Data Posture Policies for AWS (including Bedrock models), Azure (including AI Foundry Hubs), On-Premises MySQL, and Snowflake. Adds automatic exclusion of log data stores (Network Flow, RDS Audit, ALB ALB AWS Application Load Balancer, a managed Layer 7 load balancer from Amazon that routes HTTP/HTTPS traffic by host, path, or header, giving tools flexible ingress control without managing their own proxy. , NLB) from scanning to improve efficiency. Adds Scan Rules for configuring data scan schedule granularity for data stores. Adds Notification Emails feature to send configuration/permission issue alerts during tenant onboarding.
+6 more
show less
Adds Saved Views capability on Resource Inventory, AI Inventory, and Compliance pages. Adds support for scanning on-premises file servers via the On-Premises Scanner. Adds resource names (instead of instance IDs) for AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. VMs in the Resource Inventory. Adds new posture labels for Azure File Share, Azure Storage Account Table, Snowflake, and Azure Databricks. Adds support for scanning sensitive data in Azure Databricks workspaces. Adds Is Dormant and Stale Access Keys predicates for querying Snowflake resources in Investigation & Policy Query.
11 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-09-24
Sep 24, 2025
· release notes
New ZTW CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API endpoints for DNS control, gateways, forwarding rules, and resource management
Adds GET /ecRules/self, POST /ecRules/self, PUT /ecRules/self/{ruleId}, and DELETE /ecRules/self/{ruleId} endpoints to manage log and control forwarding rules programmatically. Adds GET /ecRules/ecDns, POST /ecRules/ecDns, PUT /ecRules/ecDns/{ruleId}, and DELETE /ecRules/ecDns/{ruleId} endpoints to manage DNS Control Forwarding Rules. Adds GET /dnsGateways, GET /dnsGateways/lite, POST /dnsGateways, PUT /dnsGateways/{gatewayId}, and DELETE /dnsGateways/{gatewayId} endpoints for full lifecycle management of DNS Gateways. Adds GET /gateways/{gatewayId} and PUT /gateways/{gatewayId} endpoints to update or retrieve Forwarding Gateway configurations. Adds GET /ecRules/ecRdr/{ruleId} and DELETE /ecRules/ecRdr/{ruleId} endpoints to retrieve or delete forwarding rule configurations.
+3 more
show less
Adds GET /ipSourceGroups/{ipGroupId}, PUT /ipSourceGroups/{ipGroupId}, GET /ipDestinationGroups/{ipGroupId}, PUT /ipDestinationGroups/{ipGroupId}, GET /ipGroups/{ipGroupId}, and PUT /ipGroups/{ipGroupId} endpoints for source, destination, and general IP group management. Adds GET /networkServices/{serviceId}, POST /networkServiceGroups, GET /networkServiceGroups/{groupId}, PUT /networkServiceGroups/{groupId}, and DELETE /networkServiceGroups/{groupId} endpoints to manage network services and service groups. Adds GET /workloadGroups and GET /workloadGroups/lite endpoints to retrieve Workload Group details.
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-24
Sep 24, 2025
· release notes
ZIA adds Post-Quantum Cryptography Post-Quantum Cryptography Cryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. visibility logs and customizable quarantine locations for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. file sharing apps
Adds Post-Quantum Cryptography Visibility Report in Analytics > Interactive Reports > Web Activity to track PQC PQC Cryptography designed to stay secure against a large quantum computer, which could break today's RSA and elliptic-curve keys. NIST standardized the first algorithms in 2024 as ML-KEM, ML-DSA and SLH-DSA. key algorithms and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS versions Adds new Web Insights data types: PQC vs. Classical Key Exchange, Top PQC Key Exchange Algorithms , and Top Users with PQC Key Exchange Adds client and server-side TLS algorithm filters and columns to Web Insights Logs (e.g., Client Digital Signature Proposal , Server-Side Key Exchange Algorithm ) Adds new NSS feed output fields for web logs including %d{client_tls_keyex_pqc_offers}, %s{client_tls_keyex_alg}, and others Enables specifying a custom quarantine location for Google Drive, OneDrive, and SharePoint in SaaS Security Data at Rest Scanning DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /Malware policies
+1 more
show less
Adds Admin Quarantine and Restore Admin Quarantine remediation options for file sharing apps on the Assets with Incidents page
6 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-09-24
Sep 24, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI inventory, scan rules for scheduling, on-prem scanner for file shares, Snowflake predicates, and saved views across multiple pages.
Adds AI Inventory page for managing and analyzing AI/ML resources in cloud environments Adds Data Posture Policies with specific checks for AWS, Azure, On-Premises MySQL, and Snowflake (e.g., 'AWS Bedrock Custom Model containing sensitive data can be invoked by external entities') Introduces Scan Rules configuration to customize data scan schedules for greater granularity Adds support for scanning on-premises file servers via the On-Premises Scanner deployment Adds Saved Views functionality allowing users to save filtered/customized table views on Resource Inventory, AI Inventory, and Compliance pages
+4 more
show less
Adds Snowflake predicates Is Dormant and Stale Access Keys for use in Investigation & Policy Queries Enables notification emails to specific recipients for onboarding configuration or permission issues Supports Azure Databricks discovery and classification of sensitive data Displays resource names for AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. virtual machines in the Resource Inventory instead of instance IDs
9 details in Everything
└──▷ BREAKING ON UPGRADE
! DSPM has migrated to Authentication Service; users must now access the DSPM Admin Portal via the Authentication Service Landing Page and manage users/roles there.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-23
Sep 23, 2025
· release notes
ZPA adds Extranet client type to Access Policies and Azure prebuilt Network Connector image.
Enables Extranet as a supported client type in Access Policies Provides new Azure prebuilt Network Connector image for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. redundancy Updates Manager software (v25.47.3) to restart automatically after OS library changes
3 details in Everything
Private Access (ZPA) — Network Connector Release Summary (2025) — 2025-09-23
Sep 23, 2025
· release notes
Network Connector 25.47.3 adds OS log forwarding on failed updates and immediate Manager restarts after library changes
Adds Network Connector capability to send operating system logs to event logs if an OS update fails in future releases. Improves Manager Software resilience by ensuring it immediately restarts when underlying libraries change after a successful OS upgrade. Updates the Network Connector RPM package for Red Hat Enterprise Linux 9.x.
3 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2025) — 2025-09-23
Sep 23, 2025
· release notes
ZPA Private Service Edge 25.47.3 adds end-user migration to Authentication Service and auto-restart on Manager library changes
Manager software immediately restarts after OS upgrade if underlying libraries change, preventing dependency errors
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-23
Sep 23, 2025
· release notes
ZIA adds custom DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file types, quarantine location configuration, and corresponding API endpoints.
Supports specifying a desired quarantine location for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning policies in Google Drive, Microsoft OneDrive, and Microsoft SharePoint. Enables creation of Custom File Types for use in DLP and File Type Control policies. Adds Download User-Defined File Type and Upload User-Defined File Type filters/columns to Web Insights Logs. Adds NSS filter attributes customDownloadFiletype and customUploadFiletype. Deploys new Cloud Service API endpoints for managing custom file types: GET /fileTypeCategories, GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, GET /customFileTypes/{id}, DELETE /customFileTypes/{id}, GET /customFileTypes/count.
+1 more
show less
Replaces fileTypes attribute with fileTypeCategories in /webDlpRules and /fileTypeRules endpoints.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The fileTypes attribute used in /webDlpRules and /fileTypeRules endpoints is replaced with fileTypeCategories.
Private Access (ZPA) — Private Cloud Controller Release Summary (2025) — 2025-09-23
Sep 23, 2025
· release notes
ZPA PCC v25.47.3 adds encrypted backup/restore, Notifications service integration, and new debugging/troubleshooting commands
Adds Support for remote troubleshooting (i.e., Support Information) to allow Zscaler support teams to collect diagnostic data remotely from the Private Cloud Controller. Adds Support for backup and restore with database encryption to enable encrypted database backups for the Private Cloud Controller, preserving confidentiality of stored configuration. Adds Support for the Notifications service to integrate Private Cloud Controllers with the Zscaler Notifications service for alerting and status updates. Adds Support for debugging commands to provide new CLI-based troubleshooting capabilities directly on the Private Cloud Controller appliance.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-22
Sep 22, 2025
· release notes
ZIA adds custom file types for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type Control policies with new API endpoints and UI filters.
Adds GET /fileTypeCategories, GET/POST/PUT/DELETE /customFileTypes* API endpoints to manage custom file types programmatically Adds fileTypeCategories attribute in /webDlpRules and /fileTypeRules endpoints for rule conditions using predefined and custom file types Adds ZmanageNssFeed attributes customDownloadFiletype and customUploadFiletype to filter NSS feeds by user-defined file types Adds Download User-Defined File Type and Upload User-Defined File Type filters and columns in Web Insights Logs Increases default limit of Users, Groups, Locations, & Departments in policies from 4 or 8 to 32
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The fileTypes attribute in /webDlpRules and /fileTypeRules endpoints is replaced with the fileTypeCategories attribute
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-09-19
Sep 19, 2025
· release notes
New API endpoints added to manage Cloud & Branch Connector VMs by instance ID
Adds GET /ecVm/uuid/{vmInstanceId} endpoint to retrieve detailed information about a VM using its native public cloud instance ID Adds DELETE /ecVm/uuid/{vmInstanceId} endpoint to delete a Cloud & Branch Connector VM using its native public cloud instance ID
2 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-09-19
Sep 19, 2025
· release notes
Client Connector 4.4.0.465 for Windows updates packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. mode and fixes network status display.
Updates Zscaler Client Connector to run Npcap in non-promiscuous mode (instead of promiscuous mode) when performing packet captures packet captures A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-19
Sep 19, 2025
· release notes
ZIA adds Gen AI app category to NSS feeds, SafeSearch per-app control, document sub-type logging, expandable rule limits, and several new/updated API endpoints.
Adds Gen AI as an application category in NSS and Cloud NSS feeds for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Logs, enabling selection of generative AI apps (e.g., ChatGPT) and custom Feed Output Format edits for SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. streaming Adds override Boolean query parameter to the PUT /ipDestinationGroups/{ipGroupId} endpoint on zscaler.net, zscalertwo.net, zscalerthree.net to override IPs in destination groups Adds GET /nssDownload/{nssId} endpoint to Cloud Nanolog Streaming Service (NSS) API for downloading NSS virtual appliance information by server ID Adds CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. REST endpoints for Virtual Service Edge: GET /virtualZenNodes, POST /virtualZenNodes, GET /virtualZenNodes/{virtualZenNodeId}, PUT /virtualZenNodes/{virtualZenNodeId}, DELETE /virtualZenNodes/{virtualZenNodeId} Adds CRUD REST endpoints for Workload Groups: POST /workloadGroups, GET /workloadGroups/{workloadGroupId}, PUT /workloadGroups/{workloadGroupId}, DELETE /workloadGroups/{workloadGroupId}
+7 more
show less
Adds safeSearchApps field to the AdvancedUrlFilteringCloudAppOptions model referenced in the /advancedUrlFilterAndCloudAppSettings endpoint for granular SafeSearch app control Adds UI drop-down for SafeSearch Applications on Advanced Policy Settings page (Policies > URL & Cloud App Control > Advanced Policy Settings) when Enforce SafeSearch is enabled Expands per-rule limit for users, groups, locations, and departments to 32 across Bandwidth Control, Secure Browsing, URL & Cloud App Control, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Outbound Email Policy, Endpoint DLP, Firewall Control, FTP Control, DNS Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Forwarding Control, Mobile App Store Control, Sandbox, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection, SaaS Security Adds UTF-8 BOM BOM A Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. , UTF-16 LE, UTF-16 BE file types to File Type Control and DLP (Rule without content inspection) policies under the Other category Adds 'No. of Transactions' column to Cloud Applications table in Shadow IT Report to show transactions per application status (blocked or allowed) Adds Subdocument Type filter and column to Web Insights Logs and SaaS Security Insights Logs pages for document subtypes Adds %s{upload_doc_sub_type} field to NSS/Cloud NSS feed output format for web logs and %s{upload_doc_subtype} for SaaS Security file application feeds
12 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-18
Sep 18, 2025
· release notes
ZPA adds Privileged Approval Request Email Notifications for PRA portals.
Adds Enrollment Certificate Expired and Enrollment Failed event notifications for App Connectors and ZPA Private Service Edges
1 detail in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-09-18
Sep 18, 2025
· release notes
Zscaler Risk360 adds DORA and NIS2 NIS2 EU directive that expands mandatory cybersecurity requirements to more sectors and member states than its predecessor, giving cyber tools a compliance framework to map controls and reporting obligations against. risk framework compliance support.
Adds Digital Operational Resilience Act (DORA) framework support to Risk360 assessments Adds Network and Information Security Directive 2 (NIS2) framework support to Risk360 assessments
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-17
Sep 17, 2025
· release notes
ZIA adds strict date format checking for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM templates with support for hyphen/period separated formats.
EDM (Exact Data Match) policy rules can now perform strict checking against popular date formats in Data Loss Prevention (DLP).Supported formats include 6- to 8-digit dates containing hyphens (-) or periods (.), such as 25-12-2025, 25-12-25, 25.12.2025, and 25.12.25.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-16
Sep 16, 2025
· release notes
Adds email notifications for privileged approval requests in ZPA Private Access.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-16
Sep 16, 2025
· release notes
ZIA enables stricter date format validation in DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM configurations to reduce false negatives.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-09-15
Sep 15, 2025
· release notes
Adds the Network Intelligence dashboard for visualizing network health via Cloud Path probes.
Enables configuring an alert rule to receive automatic notifications for Network Intelligence events.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-15
Sep 15, 2025
· release notes
ZIA adds custom file types to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type Control policies and expands document classification in NSS/Insights logs
Adds support for user-defined custom file types in DLP and File Type Control policies, with filters for Download User-Defined File Type and Upload User-Defined File Type added to Web Insights Logs and NSS feeds Introduces new API endpoints (GET /fileTypeCategories, GET /customFileTypes, POST /customFileTypes, PUT /customFileTypes, GET /customFileTypes/{id}, DELETE /customFileTypes/{id}, GET /customFileTypes/count) for managing custom file types via the Cloud Service API Adds Subdocument Type column and filter to Web Insights Logs and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs for categorized document logging Adds %s{upload_doc_sub_type} and %s{upload_doc_subtype} fields to NSS Feed Output Formats for web logs and SaaS Security feeds to log uploaded/downloaded document subtypes Increases the default limit of Users, Groups, Locations, and Departments in policies from 4/8 to 32
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The fileTypes attribute used in /webDlpRules and /fileTypeRules endpoints is replaced with the new fileTypeCategories attribute.
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2025) — 2025-09-12
Sep 12, 2025
· release notes
Private Service Edge groups can now be set exclusively for Business Continuity or Disaster Recovery.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-09-12
Sep 12, 2025
· release notes
ZDX Data Explorer now supports User Groups and Metric-Based filters for End User Monitoring. Cloud Path Probe configuration expands to include Probing Type, PMTU capture, and DSCP settings for enhanced network diagnostics.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-12
Sep 12, 2025
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policies, Docusign/Copilot SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. onboarding, expanded policy limits, Gen AI NSS feeds, and web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. content location match.170 chars
Adds IoT group to the Device Groups criterion in the ZIA Admin Portal (Policy > SSL Inspection > SSL Inspection Policy) to create SSL Inspection policies based on IoT AI/ML classifications. Adds a new Unauthenticated Traffic Bypass for IoT Classifications predefined rule to the SSL Inspection Policy page. Enables onboarding of Docusign and Microsoft Copilot as SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application tenants for Advanced SSPM scans via the new SSPM Scan checkbox in the Admin Portal. Extends AI/ML document classification to support ~200 new document types, adding Subdocument Type filter/column to Web Insights Logs and SaaS Security Insights Logs, and %s{upload_doc_sub_type}/%s{upload_doc_subtype} fields to NSS Feed Output Format. Adds UTF-8 BOM BOM A Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. , UTF-16 LE, and UTF-16 BE file types to File Type Control and DLP policies (rule without content inspection).
+5 more
show less
Adds No. of Transactions column to the Cloud Applications table in the Shadow IT Report. Expands the default limit for Users, Groups, Locations, & Departments in policies from 4/8 to 32, with support for further expansion upon request. Increases the limit of users, groups, departments, and locations per rule to 32 across Bandwidth Control, Secure Browsing, URL & Cloud App Control, DLP, Outbound Email Policy, Endpoint DLP, Firewall Control, FTP Control, DNS Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Forwarding Control, Mobile App Store Control, Sandbox, SSL Inspection, SaaS Security categories. Adds Gen AI as an application category in NSS and Cloud NSS feeds for SaaS Security Logs, allowing streaming of generative AI SaaS application logs (e.g., ChatGPT) to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems. Enables content location match criteria (File, Document Properties, File Content, File Name, HTTP Body) for Web DLP rules via a new dlpContentLocationsScopes attribute in the /webDlpRules API endpoints and Admin Portal.
10 details in Everything
Private Access (ZPA) — Private Cloud Controller Release Summary (2025) — 2025-09-12
Sep 12, 2025
· release notes
PCC 25.46.3: Manager restarts on library change; OS update failures now in event logs.
Manager software immediately restarts if underlying libraries change after a successful OS upgrade
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-11
Sep 11, 2025
· release notes
VMware Network Connector image updated to support upcoming VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. redundancy features; requires firewall filter rule modification if firewalld is enabled.
Zero Trust Branch — Release Upgrade Summary (2025) — 2025-09-11
Sep 11, 2025
· release notes
Zero Trust Branch 8.0.5 adds manual ZIA/ZPA synchronization via the Settings > Integrations page.
Client Connector — ZDX Module Release Summary (2025) — 2025-09-10
Sep 10, 2025
· release notes
Adds Source IP Anchoring (SIPA) Cloud Path support for ZDX
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-10
Sep 10, 2025
· release notes
ZIA adds content location match criteria for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules, OpenOffice file type support, and strict EDM date format checking.
Adds dlpContentLocationsScopes attribute to the WebDlpRule API model in /webDlpRules endpoints to configure content location matching (File, File Content, File Name, HTTP Body). Enables DLP rules to use Content Location as a match criteria, targeting specific sections of a file or transaction (File metadata/properties, File content, File name, or HTTP Body). Adds support for OpenOffice Drawings (.odg, .otg) in the OpenOffice category for DLP policy rules with content inspection. Enables strict checking of 6- to 8-digit date formats (with hyphens or periods) in DLP Exact Data Match (EDM).
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-09
Sep 9, 2025
· release notes
New Discovered Application Segments usage insights and CSV column for ZPA application discovery data
Application Segments Usage page now includes Discovered Host Count reports showing the top 10 application segments by discovered host count.Detailed report CSV files (downloaded from the Application and User Group Relationships page) now include a Discovered Application column indicating if an application was discovered.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-09
Sep 9, 2025
· release notes
ZIA adds strict EDM date formats, Gen AI report enhancements with prompt classification logs, and conditional step-up authentication.
Adds support for strict checking of popular date formats in Data Loss Prevention Exact Data Match (EDM) templates, covering 6- to 8-digit formats with hyphens or periods.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-08
Sep 8, 2025
· release notes
ZPA enables finer-grained Usage Insights by allowing administrators to choose specific SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. and SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. identity attributes.
Authentication Service — Release Upgrade Summary (2025) — 2025-09-08
Sep 8, 2025
· release notes
Adds Token Validators in the Admin Portal to validate JWTs JWTs JSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. for ZIA authorization
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-08
Sep 8, 2025
· release notes
ZIA adds expandable policy limits and content location match criteria for Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules
Increases default limit of Users, Groups, Locations, and Departments in policies from 4 or 8 to 32, with ability to request further expansion via Zscaler Sales Adds Content Location match criteria (File Document Properties, File Content, File Name, HTTP Body) for Web DLP rules targeting specific sections of files or transactions Adds dlpContentLocationsScopes attribute to the WebDlpRule model in /webDlpRules endpoints of the Cloud Service API
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-05
Sep 5, 2025
· release notes
ZPA adds Total Users/Group Size column and renames Users to Observed Users in AI Recommendation drawer
Adds a Total Users or Group Size column to the Users and Attributes tabs in the Recommended Configuration drawer to compare observed user counts against total population. Renames the existing Users column to Observed Users in the Recommended Configuration drawer for clearer distinction between observed and total users.
2 details in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-09-05
Sep 5, 2025
· release notes
Zscaler Client Connector Portal 4.4.3 adds app profile search and auto-reconnect on macOS wakeup
Adds a Search function in the App Profile policy window to locate configuration items while adding or editing profiles Adds a Reconnect Tunnel on System Wakeup feature for App Profiles to automatically restart Z-Tunnel 2.0 after macOS sleep
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-05
Sep 5, 2025
· release notes
ZIA adds Source Countries filter to URL Filtering rules, Cloud-to-Cloud DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forwarding, Gen AI NSS feeds, and REST APIs REST APIs A convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. for VSE/Workload Groups.
Source Countries field added to the Add URL Filtering Rule window (Policies > URL & Cloud App Control > URL Filtering Policy) to filter traffic by origin country.Support for Cloud-to-Cloud Incident Forwarding in DLP, allowing Inline Web, Data at Rest, Outbound Email, and Endpoint DLP incidents to be forwarded to external appliances like GCP, AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , or Azure VMs. New API endpoints GET /virtualZenNodes, POST /virtualZenNodes, GET /virtualZenNodes/{virtualZenNodeId}, PUT /virtualZenNodes/{virtualZenNodeId}, and DELETE /virtualZenNodes/{virtualZenNodeId} for creating and managing Virtual Service Edges. New API endpoints POST /workloadGroups, GET /workloadGroups/{workloadGroupId}, PUT /workloadGroups/{workloadGroupId}, and DELETE /workloadGroups/{workloadGroupId} for managing Workload Groups. New API endpoint GET /nssDownload/{nssId} to download Cloud Nanolog Streaming Service virtual appliance information.
+4 more
show less
New query parameter override (Boolean) available for the PUT /ipDestinationGroups/{ipGroupId} endpoint to override IPs. New Gen AI application category in NSS and Cloud NSS feeds for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Logs, enabling streaming of logs for generative AI applications like ChatGPT to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems. Prompt Classification filter and column added to Web Insights Logs.Limit of users, groups, departments, and locations per policy rule increased to 32 from 4 users, 8 groups, 8 departments, and 8 locations.
9 details in Everything
└──▷ BREAKING ON UPGRADE
! In /webDlpRules and /casbDlpRules endpoints, the attributes zscalerIncidentReceiver and icapServer are deprecated in favor of the new attribute receiver.! API calls using the deprecated attributes zscalerIncidentReceiver and icapServer are no longer supported.
Authentication Service — Release Upgrade Summary (2025) — 2025-09-03
Sep 3, 2025
· release notes
Adds API client access policy rules to control authorization for specific resources within a set time frame.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-09-02
Sep 2, 2025
· release notes
ZPA adds Microsegmentation features to zpatwo.net cloud and enhances API Protection diagnostics
Adds Microsegmentation policy map view in the new production microsegmentation cloud on zpatwo.net. Adds Admin Config resource type to audit logs for the microsegmentation cloud. Adds Filtering resources by status capability in the microsegmentation admin UI. Adds Agent groups filter for upgrade status in the microsegmentation agent management. Adds Azure Virtual Machine support for microsegmentation agents.
+14 more
show less
Adds Google Compute Engine support for microsegmentation agents. Adds Ubuntu Linux support for the ZPA Agent in the microsegmentation cloud. Adds Flow log filters for Direction and Resource Group Name to microsegmentation logs. Adds Microsegmentation policy enforcement capability in the zpatwo.net environment. Adds Microsegmentation policy flow logs to the zpatwo.net monitoring stack. Adds Event logs for agents and resources to the zpatwo.net audit trail. Adds Audit logs for machine learning recommended resource groups to the zpatwo.net cloud. Adds ML recommendations dashboard widget and ML recommendations for resource groups to the UI. Adds Ignored ML recommendations management capability in the microsegmentation config. Adds Resource group configuration controls for microsegmentation policies. Adds ZPA API Log Streaming Service (LSS) support for microsegmentation flow logs. Adds new filters to the AppProtection Diagnostics page: API Request , API Style , Auth type , Path , and Request method . Adds the Recent API Activity widget to the API Protection dashboard. Changes default inclusion of API Protection when configuring an application segment.
19 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-02
Sep 2, 2025
· release notes
Notes tab added to App Panel and Control Panel for collaborative comments in ZIA.
Adds a Notes tab to the App Panel in 3rd-Party App Governance and the Control Panel in Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. ) to allow users to leave notes and comment on each other's notes.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-09-01
Sep 1, 2025
· release notes
ZIA adds new 3rd-Party App Governance API endpoints for bulk actions and posture data
Adds /posture/controls/status to the 3rd-Party App Governance API for retrieving control status Adds /posture/assets/status to the 3rd-Party App Governance API for retrieving asset status Adds /posture/assets to the 3rd-Party App Governance API for listing assets Adds /posture/controls/filters to the 3rd-Party App Governance API for retrieving filter lists Adds /posture/controls to the 3rd-Party App Governance API for retrieving control details
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-29
Aug 29, 2025
· release notes
Adds a Multimatch Validation workflow in the UI to review impacts and conflicts when enabling multimatch on application segments.
Adds a Multimatch Validation window that appears when Multimatch is enabled on Application Segments to identify impacted segments and conflicting features.
1 detail in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-08-29
Aug 29, 2025
· release notes
Zscaler Client Connector Portal 4.4.3 adds App Profile search and auto-reconnect tunnel on macOS sleep wakeup.
Adds a Search function to the app profile policy window for locating configuration items during adding or editing Adds Reconnect Tunnel on System Wakeup feature to App Profiles, allowing immediate restart of Z-Tunnel 2.0 after macOS device wakes from sleep
2 details in Everything
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-08-29
Aug 29, 2025
· release notes
Zscaler EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds ROI scoring for findings, visible on a new Findings Impact page and Top 5 dashboard widget.
Adds Findings Impact page under Insights to view findings' ROI scores, impacted asset counts, and affected percentage. Adds Top 5 Findings by ROI widget on the Insights dashboard to highlight highest-ROI findings.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-08-29
Aug 29, 2025
· release notes
Data Explorer now visualizes error overlays and companion probe data for hosted monitoring.
Adds error overlays visualization in Data Explorer for hosted monitoring Adds companion probe data visualization in Data Explorer for hosted monitoring
2 details in Everything
Authentication Service — Release Upgrade Summary (2025) — 2025-08-29
Aug 29, 2025
· release notes
Simplified SMS SMS Short Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. OTP OTP One-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. flow removes country/phone re-entry step for faster authentication
Removes the country and phone number re-entry step in SMS OTP MFA OTP MFA An authentication scheme that combines a one-time password — a code valid for a single login or short window — with a second factor, so stolen passwords alone cannot grant access. , allowing direct entry of the OTP code
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-29
Aug 29, 2025
· release notes
ZIA adds Cloud-to-Cloud DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forwarding, third-party URL lookup, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. rule logging fields, and new API endpoints
Adds Cloud-to-Cloud Incident Forwarding for DLP policies to forward incidents to external appliances such as GCP, AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , or Azure VMs. Adds Enable 3rd-Party URL Category Lookup option on the Advanced Policy Settings tab (Policy > URL & Cloud App Control) for uncategorized URLs. Adds new API endpoints GET /cloudToCloudIR, GET /cloudToCloudIR/{id}, GET /cloudToCloudIR/lite, GET /cloudToCloudIR/count, and GET /cloudToCloudIR/config/{id}/validateDelete to manage Cloud-to-Cloud Incident Receivers. Updates /webDlpRules and /casbDlpRules endpoints: receiver attribute is now supported for all incident receiver types; zscalerIncidentReceiver and icapServer attributes are deprecated in favor of receiver. Adds SSL Policy Name filter and column to Web Insights Logs.
+1 more
show less
Adds %s{ssl_rulename} field to NSS Feed Output Format for web logs.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The zscalerIncidentReceiver and icapServer attributes in /webDlpRules and /casbDlpRules endpoints are deprecated and no longer supported; API calls using these attributes will fail.
Workflow Automation — Release Upgrade Summary (2025) — 2025-08-28
Aug 28, 2025
· release notes
Adds All widget to Zscaler Workflow Automation Incidents Analytics Dashboard
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-27
Aug 27, 2025
· release notes
New AWS image available for Zscaler Private Access App Connectors to support automated Manager and OS updates.
Adds a new AWS machine image for ZPA App Connectors to facilitate upcoming automated Manager software and OS security updates.
1 detail in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-08-22
Aug 22, 2025
· release notes
Client Connector Portal 4.4.3 adds app profile search and auto-reconnect on macOS sleep
Adds a Search function in the App Profile policy window to locate configuration items when adding or editing profiles Adds Reconnect Tunnel on System Wakeup feature to App Profiles for immediate Z-Tunnel restart after macOS sleep
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-22
Aug 22, 2025
· release notes
ZIA adds Gen AI report insights, 3rd-party URL lookup, API search params, and EUSA endpoints
└──▷ USE IT
Configure NSS feed output format to include SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. rule name in logs
text
copy
%s{ssl_rulename}
Adds Enable 3rd-Party URL Category Lookup option on the Advanced Policy Settings tab (Policy > URL & Cloud App Control) to allow lookup for uncategorized URLs using a third-party database Adds new request parameters srcIps, destAddresses, srcIpGroups, destIpGroups, nwApplication, nwServices, and destIpCategories to the GET /firewallFilteringRules API endpoint to support searching firewall rules by IP, groups, application, service, or category Adds new API endpoints GET /eusaStatus/latest and PUT /eusaStatus/{eusaStatusId} to the cloud service API for programmatic access to End User Subscription Agreement (EUSA) acceptance status Adds Prompt Classification as a filter and column in Web Insights Logs and an Analyze More option in the Gen AI Security Report to view sanctioned/unsanctioned usage, content types, and department-level visibility Adds SSL Policy Name as a filter and column in Web Insights Logs, and supports %s{ssl_rulename} field in NSS Feed Output Format for web logs
5 details in Everything
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-08-20
Aug 20, 2025
· release notes
Adds PPTX report generation for individual EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. organizations via the Administration UI
Enables administrators to generate PPTX reports for individual EASM organizations, translating automated discovery findings into strategic insights.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-20
Aug 20, 2025
· release notes
ZIA DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. now supports OpenOffice Drawings (.odg, .otg) for content inspection
Data Loss Prevention (DLP) policies now inspect OpenOffice Drawings files (.odg, .otg)
1 detail in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-08-20
Aug 20, 2025
· release notes
Adds weekly/on-demand Operating Entity Risk Report for portfolio risk assessment
Adds the Operating Entity Risk Report on the Reports page for quantifying risk at the operating entity level with configurable entity source
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-19
Aug 19, 2025
· release notes
ZIA adds OpenOffice DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support and Step-Up Authentication for high-risk access.
OpenOffice Drawings (.odg, .otg) file types are now supported in DLP policies with Content Inspection. Step-up authentication can be configured via URL Filtering and Cloud App Control policies to require additional identity verification before accessing sensitive resources.
2 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-08-19
Aug 19, 2025
· release notes
Risk360 adds granular DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. factors replacing the deprecated Are DLP Policies Configured factor.
Adds Data in Motion , Data at Rest , and Endpoint DLP factors to the Data Loss Prevention category for risk quantification Adds Outbound Email DLP and General DLP factors to the Data Loss Prevention category Removes the Are DLP Policies Configured factor from the Risk360 Admin Portal
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The existing Are DLP Policies Configured factor is no longer available in the Risk360 Admin Portal.
Deception — Release Upgrade Summary (2025) — 2025-08-18
Aug 18, 2025
· release notes
Zscaler Deception adds AI decoy recommendations, new dashboard queries, landmine policy visibility, and ThreatParse rules.
AI-Powered Recommendations for Zero Trust Network Decoys generate pre-configured decoys using AI analysis of ZPA deployments Dashboard Enhancements include advanced queries like Internal - High Priority Threat Detection, Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Threat Detection, Identity Threat Detection, CVE Threat Detection, External - High Priority Threat, Lateral Movement, Database Threat Detection, Cloud Threat Detection, and Whitelisted Events in the Select Query drop-down menu Attack Types filter includes a new Cloud option to filter alerts New ThreatParse Rules detect exploits for Ivanti Endpoint Manager Mobile (CVE-2025-4427), Themewinter Eventin (CVE-2025-47539), Dassault Systèmes DELMIA Apriso (CVE-2025-5086), Commvault Command Center (CVE-2025-34028), and Microsoft Sharepoint (CVE-2025-53770) User Interface Changes and Enhancements rename tabs in the Zscaler Deception Admin Portal: Settings > User & Roles > SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Providers, Settings > Users & Roles > Support Users to Zscaler Remote Assistance, Settings > Advanced Settings > Maintenance to Manage Events & Evidence, and Settings > Advanced Settings > Debugging to Show/Hide Internal Components
+1 more
show less
View Landmine Policies in Landmine-Based Events adds the landmine.applied_policies field to the Events page
6 details in Everything
└──▷ BREAKING ON UPGRADE
! Settings > User & Roles > SSO is renamed to IdP Providers! Settings > Users & Roles > Support Users is renamed to Zscaler Remote Assistance! Settings > Advanced Settings > Maintenance is renamed to Manage Events & Evidence! Settings > Advanced Settings > Debugging is renamed to Show/Hide Internal Components
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-18
Aug 18, 2025
· release notes
ZIA adds folder-level permission triggers for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy rescans in OneDrive and SharePoint
Adds automatic DLP policy rule rescanning for files in OneDrive and SharePoint folders when permissions are modified or shared with a new collaborator
1 detail in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-08-18
Aug 18, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds unmanaged AI detection, stale data insights, Identity Inventory, and wildcard scan exclusions
Adds Dashboard Enhancements with clickable AI Security summary tiles and resource type hover details Adds Detection of Unmanaged AI Services and Models scanning VMs for installed services via policy alerts Adds Stale Data Detection for data untouched for over 90 days with specific dashboard tiles (AWS S3, AWS, Azure, GCP) Adds Support for AWS Bedrock Custom Models visibility for custom and imported models Adds new Data Posture Policies for AWS, Azure, GCP, Snowflake, and On-Premises environments covering sensitive data and encryption controls
+5 more
show less
Adds Identity Inventory feature to scan for identities with excessive privileges and access details Adds Snowflake Entitlements details in Resource Inventory including permission grants and investigation queries Adds Evidence UI Enhancements showing DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine relevance, file prefix/suffix context, and direct original file links Adds Monitor Identities Having Access to Sensitive Files tab showing identity actions and source IP for last 7 days (AWS S3 only) Enables use of wildcards to exclude AWS, Azure, and GCP data stores from scanning in scan settings
10 details in Everything
Zero Trust Branch — Release Upgrade Summary (2025) — 2025-08-18
Aug 18, 2025
· release notes
ZTB 8.0.4 adds DHCP on WAN for activation, custom DNS policies with gateways/responses/rejects, BGP BGP A routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. support, and ZT8010 hardware support.
Allows DHCP to be used on the primary WAN interface for device activation Enables configuration of custom Site DNS Policies with defined DNS gateways, match conditions (source IP/CIDR CIDR A notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. + FQDN), and actions (forward, override, reject) Adds predefined DNS policies for Zscaler domains (redirect to WAN DNS), AppC process queries (forward to private DNS), and app segment FQDNs (synthetic IP) Establishes predefined routing policies (Default-ZPA-PBR, Default ZIA Rule, Default-App-Segment-PBR) and firewall policy for Airgap Network Adds border gateway protocol (BGP) support on WAN links for active/standby gateways to pre-learn routes
+2 more
show less
Adds DHCP relay support over routed tunnel and ZPA app segments Supports the ZT8010 platform with 8x 10G SFP+ ports, 10x GbE RJ45 ports, and redundant power supply
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-15
Aug 15, 2025
· release notes
ZPA adds Exists key option for network tag resource groups and new disconnection session status codes.
Adds an Exists selection in the resource group tag config to match tags by presence rather than value, disabling the value field.
1 detail in Everything
Client Connector — ZDX Module Release Summary (2025) — 2025-08-15
Aug 15, 2025
· release notes
ZDX Module 4.4.1.12 enhances remote PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. with configurable durations, file sizes, and header/payload filtering
ZDX Module 4.4.1.12 adds support for longer packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. durations in ZDX.ZDX Module 4.4.1.12 allows configuring maximum file sizes for remote PCAP captures.ZDX Module 4.4.1.12 enables header- or payload-specific data collection options for remote PCAP.
3 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-08-15
Aug 15, 2025
· release notes
Client Connector adds alwaysAllowed firewall param for macOS and fixes Windows PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parser crash with V8 JS parser
Adds alwaysAllowed parameter to the macOS firewall configuration to control bypassed traffic handling Introduces V8 JavaScript based PAC Parser as a configurable option in the app profile to resolve ZSATunnel crashes
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The detectAltInterfaceTraffic firewall parameter is deprecated on macOS and must be replaced with enforceTrafficViaTunnel in MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. configurations.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-15
Aug 15, 2025
· release notes
ZIA adds third-party URL lookup, EUSA API, device group forwarding, Gen AI report filters and audit log search.
Adds GET /eusaStatus/latest and PUT /eusaStatus/{eusaStatusId} endpoints to the cloud service API for programmatic EUSA status retrieval Adds the Enable 3rd-Party URL Category Lookup option in Advanced Policy Settings to look up uncategorized URLs via a third-party database Adds Device Groups criterion in Forwarding Control policy window to filter forwarding rules by device platform
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
ZPA Private Access adds LAN IP/subnet support for legacy VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. segments and Multimatch validation window.
Supports adding LAN IP addresses and subnets for VPN (for Legacy Apps) network segments Adds a Multimatch Validation window to review impacted application segments and conflicting features when Multimatch is enabled
2 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
Workflow Automation adds Cloud-to-Cloud DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. forwarding to AWS/Azure and new Incidents Dashboard widgets
Adds Cloud-to-Cloud Forwarding support in the DLP Application Integration for sending incident metadata and evidence files to AWS S3 storage buckets and Azure storage containers via the ZIA Admin Portal.
1 detail in Everything
Private Access (ZPA) — Network Connector Release Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
Network Connector 25.46.2 updates RPM packages for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.x/9.x and prepares Diagnostics page details.
Private Access (ZPA) — App Connector Release Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
ZPA App Connector 25.46.2 introduces container security enhancements for Kubernetes and extends platform support to RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.x/9.x via RPM packages, alongside general optimizations.
Supports Kubernetes enhancements to improve container security Provides updated App Connector RPM packages for Red Hat Enterprise Linux 8.x and 9.x
2 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
ZPA Private Service Edge 25.46.2 adds exclusive Business Continuity/Disaster Recovery group configuration.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
ZIA adds new EDM data types for Uruguay and Chile/Peru DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. templates, plus folder-level rescanning in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security DLP.
Adds National Document ID (Uruguay), National Identification Number (Chile), and National Identification Number (Peru) as selectable EDM data types for DLP templates Enables automatic rescan of files in Microsoft OneDrive and SharePoint folders when permissions are modified or the folder is shared with a new collaborator
2 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
Zscaler Risk360 adds Cyber Insurance Addendum Report for on-demand or quarterly download.
Private Access (ZPA) — Private Cloud Controller Release Summary (2025) — 2025-08-14
Aug 14, 2025
· release notes
ZPA Private Cloud Controller 25.46.2 adds Business Continuity mode forcing and sync time reporting
Adds support for forcing Private Cloud Controllers, App Connectors, and ZPA Private Service Edges into Business Continuity mode. Adds support for reporting the last policy/configuration and user sync times for Private Cloud Controllers.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-13
Aug 13, 2025
· release notes
ZPA adds new Cloud Service API endpoints for programmatic control of Application Segment Multimatch.
Adds POST /customers/{customerId}/application/multimatchUnsupportedReferences endpoint to manage unsupported references in application segment multimatch programmatically Adds PUT /customers/144118148382064640/application/bulkUpdateMultiMatch endpoint for bulk updates of application segment multimatch settings
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-13
Aug 13, 2025
· release notes
ZIA adds SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Policy Name filter/column in Web Insights Logs and %s{ssl_rulename} field to NSS Feed Output Format
└──▷ USE IT
Include the SSL rule name in outgoing web log feeds for downstream SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. analysis.
text
copy
%s{ssl_rulename}
Adds SSL Policy Name as a filter and column in ZIA Admin Portal Web Insights Logs to identify which specific SSL Inspection rules were applied to web transactions Adds %s{ssl_rulename} field to NSS or Cloud NSS feed output format for web logs to export the associated SSL rule name
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-08-13
Aug 13, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds custom tag validation, unmanaged AI detection, stale data metrics, Identity Inventory, wildcard scan exclusion, and Evidence UI enhancements.
Enables Custom Tag Validation to align onboarding tags with CSP CSP Content Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. guidelines during account onboarding Adds unmanaged AI services and models detection by scanning VMs and raising policy alerts for specific risk Introduces Stale Data Detection with insights for files accessed or modified >90 days across AWS, Azure, GCP Provides visibility into AWS Bedrock Custom Models and AWS Bedrock Imported Models in the AI Security dashboard Adds 29 new data posture policies across AWS, Azure, GCP, Snowflake, and On-Premises environments
+5 more
show less
Launches Identity Inventory to scan data stores for identities with excessive privileges and sensitive access Expands Resource Inventory with Snowflake entitlements and database access analysis via investigation queries Enhances Evidence UI with prefix/suffix context for file triggers, relevant DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines, and original file links Adds Monitor Identities Having Access to Sensitive Files tab showing identity actions and source IPs for last 7 days Supports wildcard exclusions in scan settings for AWS S3, Azure storage, and GCP Cloud Storage data stores
10 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-11
Aug 11, 2025
· release notes
The AI-Powered Recommendations by Confidence % widget is renamed to AI-Powered Recommendations by Attack Surface Reduction % in the Applications dashboard.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-08
Aug 8, 2025
· release notes
ZPA App Connector Helm chart consolidation, new capability modes, and multi-file isolation uploads.
Supports capabilityMode values of minimal, full, or custom in the unified zpa-app-connector Helm chart to control container security capabilities Allows setting createNamespace: true/false in values.yaml to control automatic namespace creation during deployment Supports labels in values.yaml to add deployment-level labels for monitoring and alerting Enables uploading multiple files simultaneously in ZPA isolation sessions with no upload limits
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The Helm chart directories zscaler-et-dist/helm-charts/k8s/ and zscaler-et-dist/helm-charts/openshift/ are deprecated in favor of the new unified zpa-app-connector chart! For Kubernetes deployments of App Connector version 25.45.1 or earlier, using minimal or custom capabilityMode will cause unexpected behavior; only full mode is safe
Authentication Service — Release Upgrade Summary (2025) — 2025-08-08
Aug 8, 2025
· release notes
Zscaler Authentication Service adds login/logout visibility to the Audit Logs page
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-08
Aug 8, 2025
· release notes
ZIA adds device groups to forwarding rules, step-up auth for conditional access, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. types, and API updates for EUSA status and firewall search.
Adds Device Groups criterion in Policy > Forwarding Control > Add Forwarding Rule window for platform-based forwarding Enables step-up authentication with conditional access in ZIA Admin Portal URL Filtering and Cloud App Control policies Expands Audit Logs search on zscalerone.net to support searching JSON attribute values via the Changes filter Updates GET /firewallFilteringRules API endpoint to accept srcIps, destAddresses, srcIpGroups, destIpGroups, nwApplication, nwServices, and destIpCategories parameters Adds GET /eusaStatus/latest and PUT /eusaStatus/{eusaStatusId} endpoints to the cloud service API for EUSA acceptance status
+1 more
show less
Adds National Document ID (Uruguay), National Identification Number (Chile), and National Identification Number (Peru) as selectable EDM data types in DLP templates
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-08-07
Aug 7, 2025
· release notes
ZPA adds RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 Private Cloud Controller images to AWS and Azure Marketplaces.
Business Insights — Release Upgrade Summary (2025) — 2025-08-07
Aug 7, 2025
· release notes
Zscaler Business Insights now allows users to filter application insights on the All Applications page using multiple criteria such as risk index and contract dates.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-08-07
Aug 7, 2025
· release notes
ZIA adds collaborator group filtering in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights logs and NSS feed output fields for File Sharing Applications.
Adds %s{intcollab_groups}, %s{ointcollab_groups}, %s{b64intcollab_groups}, %s{extcollab_groups}, %s{oextcollab_groups}, and %s{b64extcollab_groups} to NSS Feed Output Format for File applications. Adds External Collaborator Group and Internal Collaborator Group filters and columns to SaaS Security Insights Logs for the File Sharing Applications category. Adds External Collaborator Group and Internal Collaborator Group columns and advanced filters in the Files tab of Assets with Incidents (Analytics > SaaS Security > Assets > Assets with Incidents). Supports number of internal and external collaborators as scoping criteria for Google Drive in SaaS Security Data at Rest Scanning DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy.
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-08-01
Aug 1, 2025
· release notes
ZDX adds 95th and 99th percentile threshold overlays for Cloud Path probes in hosted monitoring.
Workflow Automation — Release Upgrade Summary (2025) — 2025-07-31
Jul 31, 2025
· release notes
Workflow Automation adds email notification subject lines, incident label bulk actions, and other email recipients in mappings.
Adds a Subject Line field when adding, editing, or cloning an email notification template Adds Add and Remove options for label actions on the Incidents page Adds Other Email Recipients property to the Email Source DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Type in Incident Group Mappings and Workflow Mappings
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-30
Jul 30, 2025
· release notes
Adds RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 container support with automated micro-dnf patching for ZPA infrastructure components.
Risk360 — Release Upgrade Summary (2025) — 2025-07-30
Jul 30, 2025
· release notes
Adds Posture Profiles Not Used in Access Policies factor to Lateral Propagation category
Client Connector — Client Connector App Release Summary (2025) — 2025-07-28
Jul 28, 2025
· release notes
Zscaler Client Connector 4.5.0.478 adds partner tenant domain validation and improves machine tunnel posture checks.
Adds validation to prevent adding a partner tenant that shares the same domain as the main tenant
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-28
Jul 28, 2025
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenant label management, GitHub App Excessive Data Permissions finding, and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file access correlation.
Adds label management for SaaS application tenants in 3rd-Party App Governance and Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Introduces the Excessive Data Permissions detection finding for GitHub apps
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-25
Jul 25, 2025
· release notes
ZIA adds content location match criteria for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , customizable confirmation templates, ATP URL comments, and new log fields.
Adds dlpContentLocationsScopes attribute to the WebDlpRule model in /webDlpRules API endpoints Adds content location match criteria (File Metadata, File Content, File Name, HTTP Body) for Web DLP rules Allows adding comments to malicious URLs in Advanced Threat Protection Blocked Malicious URLs lists Enables multiple customizable User Confirmation templates for policy-level notifications Adds matchCount enhancement to EDM Match Count based on unique token sets
+4 more
show less
Adds PDF download of Zscaler ThreatLabz updates from Cybersecurity Insights page Adds Allowed File Type Rule filter and column in Web Insights Logs Adds %s{ft_rulename} field to NSS Feed Output Format for web logs Adds Bandwidth by Data Center filter in Web Insights
9 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-21
Jul 21, 2025
· release notes
ZPA adds provisioning key hiding in Admin Portal and new API endpoints for API keys, IP ranges, and more.
Adds ability to hide provisioning keys in the ZPA Admin Portal so they don't appear in the UI and can't be copied or downloaded Adds new API endpoint GET /mgmtconfig/v1/admin/customers/{customerId}/apiKeys/{id} to retrieve specific API keys Adds new API endpoint POST /mgmtconfig/v1/admin/customers/{customerId}/apiKeys to create API keys Adds new API endpoint PUT /mgmtconfig/v1/admin/customers/{customerId}/apiKeys/{id} to update existing API keys Adds new API endpoint DELETE /mgmtconfig/v1/admin/customers/{customerId}/apiKeys/{id} to delete API keys
+8 more
show less
Adds new API endpoint GET /mgmtconfig/v1/admin/customers/{customerId}/v2/ssoLoginOptions to retrieve SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login options Adds new API endpoint POST /mgmtconfig/v1/admin/customers/{customerId}/v2/ssoLoginOptions to create or update SSO login options Adds new API endpoints GET, POST, PUT for /mgmtconfig/v1/admin/customers/{customerId}/configOverrides to manage config overrides Adds new API endpoints GET, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/privateCloudController/{privateCloudControllerId} and related restart endpoint Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/privateCloudControllerGroup/... to manage controller groups Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/userPortal/... to manage user portals Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/userPortalLink/... and bulk creation via v2 Adds new API endpoints GET, POST, PUT, DELETE for /mgmtconfig/v1/admin/customers/{customerId}/v2/ipRanges/... to manage IP ranges
13 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-07-21
Jul 21, 2025
· release notes
Adds TLS tunnel mode and automatic fallback for Cloud Connectors in Zscaler Cloud & Branch Connector
Enables selection of TLS as the tunnel mode when editing a Cloud Connector
1 detail in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-07-18
Jul 18, 2025
· release notes
Zscaler Client Connector Portal 4.4.2 adds Z-Tunnel 2.0 app profile options and OTP OTP One-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. refresh for Authentication Service devices
Adds Z-Tunnel 2.0 as an option in App Profiles for Android and Android on ChromeOS devices Adds Refresh Status option in the Compliance Status section of the Device Details window Updates OTP support to include devices belonging to Authentication Service users Updates the Upload File feature in VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass to accept TXT file formats alongside CSV
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-07-18
Jul 18, 2025
· release notes
ZDX adds Multipath visualization view for Cloud Path probes in hosted monitoring
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-18
Jul 18, 2025
· release notes
ZIA adds ATP URL comments, customizable DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. confirmation templates, NSS feed location filter and policy download to JSON
Adds Add Custom Message button in Administration > Notification Templates > User Confirmation for creating multiple user confirmation templates Adds %s{ft_rulename} field to NSS Feed Output Format for Web logs Adds ZIP and PDF export options on the Print All Policies page for downloading configured policies Adds locationGroups filter to NSS and Cloud NSS feeds for Web, Firewall, DNS, and MCAS logs Updates /nssFeeds API endpoints to include new locationGroups attribute in the ZmanageNssFeed model
+1 more
show less
Adds Allowed File Type Rule filter and column to Web Insights Logs
6 details in Everything
└──▷ BREAKING ON UPGRADE
! Existing Firewall/Forwarding rules using the Department field without Advanced Firewall entitlement become non-editable; only deletion is allowed.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-17
Jul 17, 2025
· release notes
ZPA adds ML Recommendation management and extensive Cloud Service API endpoints for programmatic control of APIs, controllers, portals, and IP ranges.
Adds GET /mgmtconfig/v1/admin/customers/{customerId}/v2/ssoLoginOptions, POST .../v2/ssoLoginOptions, PUT .../privateCloudController/{id}/restart, and other endpoints for programmatic access to ZPA features. Enables management of ignored ML Recommendations in Microsegmentation resource groups, allowing review and acceptance of previously ignored suggestions. Adds an ML Recommendations Dashboard Widget to the Overview Dashboard showing enablement status and recommendation counts for Microsegmentation.
3 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-07-17
Jul 17, 2025
· release notes
Adds Restrict Approver Email Domains option to limit approvers to trusted domains
Authentication Service — Release Upgrade Summary (2025) — 2025-07-15
Jul 15, 2025
· release notes
New Authentication Service APIs for identity and lifecycle management
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-14
Jul 14, 2025
· release notes
ZPA adds Usage Insights and limited Availability Application Segments Usage reports.
Adds Usage Insights dashboard to view actionable insights into organization's usage patterns between users and applications. Adds Application Segments Usage reports (view/download) in ZPA Admin Portal for customers with Segmentation add-on, providing visibility into actively used segments and user group access.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-14
Jul 14, 2025
· release notes
ZIA adds four new ML-based DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries and extends Australian Passport PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. format support
Adds new predefined DLP dictionaries for ID Card , Medical Imaging , Satellite Data , and Schematic Data using ML-based detection Extends Australian Passport number support in EDM and DLP predefined dictionaries to the AAn(6) format with optional delimiters
2 details in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-07-11
Jul 11, 2025
· release notes
Zscaler Client Connector Portal 4.4.2 adds Z-Tunnel 2.0 support and OTP OTP One-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. refresh.
Adds Z-Tunnel 2.0 as an app profile option for Android and Android on ChromeOS devices Updates the Device Details window to automatically refresh one-time passwords (OTPs) every 60 minutes and adds a manual Refresh Status button in the Compliance Status section Extends the Upload File feature in VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Gateway Bypass App Profiles to accept TXT file formats alongside existing CSV support Adds OTP support for devices belonging to Authentication Service users in the Portal
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-11
Jul 11, 2025
· release notes
ZIA adds Location Groups filter for NSS feeds, ATP URL comments, and policy export formats
Adds locationGroups attribute to /nssFeeds API endpoints via the ZmanageNssFeed model. Adds a Location Groups filter option when configuring NSS and Cloud NSS feeds for Web, Firewall, and DNS logs, as well as MCAS NSS feeds. Enables adding comments to malicious URLs in the Advanced Threat Protection (ATP) Blocked Malicious URLs list. Adds JSON export capability for policies via the Administration > Print All Policies page (ZIP format with individual JSON files per policy type). Adds Allowed File Type Rule filter and column to Web Insights Logs.
+1 more
show less
Adds %s{ft_rulename} field to NSS/Cloud NSS feed output formats for web logs.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The Department field in Firewall and Forwarding rules is now restricted by Advanced Firewall entitlement; existing rules using this field without the license become non-editable and can only be deleted.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-07-10
Jul 10, 2025
· release notes
ZPA adds AI-powered recommendation UI features and increases PRA console limit to 9,000
Adds Recommended Users column to AI-Powered Recommendations page for Application Segments Adds Groups or Attributes tab in Recommended Configuration drawer showing SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. groups and attributes Adds copy list of recommended users feature in the Recommended Configuration drawer Adds download missing users option from warning message in Recommended Configuration drawer Enables email search within the Groups or Attributes tab for recommended/observed users
+3 more
show less
Allows creation of access policy rules at the Policies step when adding an application segment from AI recommendations Increases maximum total privileged consoles per Privileged Remote Access (PRA) Portal to 9,000 Adds VMware and Nutanix images for App Connector deployment
8 details in Everything
Authentication Service — Release Upgrade Summary (2025) — 2025-07-10
Jul 10, 2025
· release notes
Authentication Service now enforces MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for admins via external IdPs with configurable grace periods and override options.
Adds Enforce Zscaler Admin MFA option on the Add Primary or Secondary Identity Provider page to require second-factor authentication for admins Provides a 7-day grace period for admins authenticating through external IdPs to temporarily skip MFA before enforcement begins
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-07-10
Jul 10, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI Foundry predicates, Snowflake support, on-demand scanning, custom compliance frameworks, Data Inventory, and new data posture policies
Adds Has Model, Model Name, Model Format, and Model Version investigation predicates for Azure AI Foundry sensitive data correlation Adds Australian Signals Directorate Essential Eight , Transportation Security Administration Security Directive Pipeline 2021-02 , Healthcare and Public Health Sector's Cybersecurity Performance Goals , and Digital Operational Resilience Act to the Compliance dashboard framework list Enables cloning existing compliance frameworks or creating new ones from scratch for custom compliance requirements Adds Data Inventory page providing a comprehensive overview of sensitive files and tables across clouds, accounts, and data stores Adds On-Demand scan option to manually trigger scans for all resource types including virtual machines and databases
+8 more
show less
Supports Cloud resource tags as an exclusion factor in data scanning settings Enables configuration of specific start time windows for scanning unmanaged databases Adds HashiCorp Vault support for hosting keys used in database scanning Adds Snowflake database support for sensitive data scanning and security assessments Adds Data Posture Policies for AWS, Azure, GCP, and On-Premises targets covering risks like misconfigured IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles and disabled encryption Adds Resource Timeline tab displaying configuration and management change events for resources across time periods Adds AI & ML tab for Virtual Machines listing installed AI packages and models Provides detailed view of unmanaged and custom AI models and services installed on virtual machines across AWS, Azure, and GCP
13 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-07-10
Jul 10, 2025
· release notes
Risk360 now supports the ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. /IEC 27001:2022 framework for ISMS analysis.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-07-08
Jul 8, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Snowflake support, unmanaged database scan windows, custom compliance frameworks, and an AI & ML VM tab.
Support for Australian Signals Directorate Essential Eight , Transportation Security Administration Security Directive Pipeline 2021-02 , Healthcare and Public Health Sector's Cybersecurity Performance Goals , and Digital Operational Resilience Act compliance frameworks. Ability to configure custom compliance frameworks by cloning existing ones or creating new ones from scratch. On-Demand scanning for virtual machines, databases, NoSQL databases, and unmanaged databases. Scan Start Time Configuration for unmanaged databases to define specific time windows for scanning.Cloud resource tags as an exclusion factor in data scanning settings.
+3 more
show less
Hash of scanned files for malware scanning displayed on the Sensitive tab of the Resource Inventory. AI & ML Tab for Virtual Machines listing installed AI & Machine Learning packages and models.Unmanaged AI Service Discovery dashboard view for custom AI models and services across AWS, Azure, and GCP.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! Data Inventory renamed to Resource Inventory.
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-07-07
Jul 7, 2025
· release notes
Cloud & Branch Connector service update enables TLS tunnel support for Cloud Connectors to ZIA.
Client Connector — Client Connector App Release Summary (2025) — 2025-07-07
Jul 7, 2025
· release notes
Client Connector adds G2 Certificate support for ZDX and introduces MatchDomainsNoSearch config key to fix iOS connectivity.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-07
Jul 7, 2025
· release notes
ZIA July 2025 adds NSS Location Groups filter, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. redaction profiles, SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for Index Tool, and new EDM data types.
Adds locationGroups attribute to the /nssFeeds API model and Location Groups filter in NSS/Cloud NSS feeds for Web, Firewall, DNS, and MCAS logs Enables DLP redaction profiles (asterisk * or hash #) for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Data at Rest Scanning policies on file sharing apps Allows removing applied redaction characters via the Assets with Incidents page in Analytics > SaaS Security Report > Assets Adds support for Australian Passport number format (AAn(6) ) in predefined DLP and EDM dictionaries Adds National Document ID (Uruguay), National Identification Number (Chile), and National Identification Number (Peru) to available EDM data types
+2 more
show less
Enables Single Sign-On (SSO) configuration for the ZIA Index Tool Adds Trusted Users and Trusted Domains support in SaaS Data at Rest Scanning DLP policies
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The Department field in Firewall and Forwarding rules is now restricted to customers with Advanced Firewall entitlement; existing rules using this field without the entitlement are non-editable and can only be deleted
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-07-02
Jul 2, 2025
· release notes
ZIA adds custom Browser EUN template support to File Type Control policy rules
Adds Browser Notification Template field in the Add File Type Control Rule window (Policy > File Type Control > Add File Type Control Rule) to configure custom end-user notifications when rule access is set to block or caution. Updates cloud application categories with newly added cloud applications, allowing download of the new list.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-06-30
Jun 30, 2025
· release notes
Private Access adds negative match operators to Custom Controls for AppProtection
Adds negative value operator options (Does not match, Does not contain, Does not start with, Does not end with, and Does not exist) to Custom Controls for AppProtection configuration Allows selecting negative request method options (Not Get, Not Put, etc.) in Custom Controls
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-06-30
Jun 30, 2025
· release notes
Cloud Connectors now support TLS tunnel mode and TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. optimization with SNI SNI A TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. learning
Adds TLS as a selectable ZIA tunnel mode for Cloud Connectors, allowing fallback detection that switches from Unencrypted UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. or DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. to TLS when the tunnel is unhealthy. Adds an integrated TCP optimization module on Cloud Connectors that learns SNI and maintains a database of IP addresses, FQDNs, and wildcard FQDN mappings to optimize HTTP/HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic without routing DNS through the connector.
2 details in Everything
Breach Predictor — Release Upgrade Summary (2025) — 2025-06-30
Jun 30, 2025
· release notes
Zscaler Breach Predictor adds SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration, User Threat Profile page, and AI Assist dashboard
Adds Integration with SIEM Applications via the Breach Predictor Portal to send event data for holistic threat visibility. Introduces the User Threat Profile page (Breach Predictor Portal > Users) with an Overview tab of charts/graphics and a Users List tab for individual user details, broken down by MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. stage, department, threat type, and geography. Rolls out various updates to the Breach Predictor Portal improving look, feel, usability, with new charts, graphs, filtering options, and updated data visibility. Adds AI Assist Dashboard (limited availability) using AI/ML for dynamic threat views, customized recommendations, Breach AI Agents monitoring overview, and dynamic prompts from any screen.
4 details in Everything
Zscaler Cellular — Release Upgrade Summary (2025) — 2025-06-30
Jun 30, 2025
· release notes
Zscaler Cellular adds CSV export for SIM lists, tag-based filtering, dashboard navigation, and refresh buttons
Total Usage field now shows aggregated data usage across SIMs in the current view on the SIMs pageSIMs page supports filtering SIMs using tags from the SIMs or SIM details page Added option to download the list of SIMs with details as a CSV file from the SIMs page Dashboard widgets (Total SIMs , Used SIMs , and SIM State Overview ) now link directly to the SIMs page with appropriate filters applied when clicking numerical values Added Refresh button to specific pages (SIMs, Network Events, and Login Tracker) to fetch and display the latest data
5 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-06-30
Jun 30, 2025
· release notes
Risk360 now supports NIST SP 800-53 for analyzing risk against federal security controls.
Business Insights — Release Upgrade Summary (2025) — 2025-06-27
Jun 27, 2025
· release notes
Adds CSV export for Footfall by Time of the Day data in Business Insights.
Adds Export button to Footfall by the Time of the Day section to download data as CSV Enables downloading footfall data for a specific week or last 7 days
2 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-06-27
Jun 27, 2025
· release notes
Zscaler Client Connector introduces PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file retrieval for WebView2 auth and macOS reconnectT2OnWake config parameter
Adds PAC file retrieval to pass proxy settings to WebView2 during enrollment Adds reconnectT2OnWake parameter in Application & Custom settings to enable quick reconnect after sleep on macOS
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-27
Jun 27, 2025
· release notes
ZIA adds Salesforce client-side onboarding, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros/EDM-IDM support, API endpoints, and file type EUNs.
Adds GET /casbDlpRules, POST /casbDlpRules, GET /casbDlpRules/all, GET /casbDlpRules/{ruleId}, PUT /casbDlpRules/{ruleId}, and DELETE /casbDlpRules/{ruleId} endpoints to manage Data at Rest Scanning DLP policies programmatically Adds GET /casbMalwareRules, POST /casbMalwareRules, GET /casbMalwareRules/all, GET /casbMalwareRules/{ruleId}, PUT /casbMalwareRules/{ruleId}, and DELETE /casbMalwareRules/{ruleId} endpoints to manage Advanced Threat Protection malware rules programmatically Adds three new inline web DLP macros for notification templates: ${DEPARTMENT}, ${FILESIZE}, and ${REFERRER_URL} Enables Exact Data Match (EDM) and Indexed Document Match (IDM) dictionaries and engines in Outbound Email DLP policy rules Adds support for Custom Browser end user notifications (EUN) with a new Browser Notification Template field in File Type Control policy rules
+4 more
show less
Adds redaction profile support for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP to mask sensitive data using asterisk (*) or hash (#) Adds ability to specify trusted users and trusted domains as exemptions in SaaS Security Data at Rest Scanning DLP policies Adds filtering by Sandbox API Key Name in Web Insight Logs via the API Key Name column category Expands Onboarding Options for Salesforce to support custom, client-side connector onboarding with minimum set credentials
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-25
Jun 25, 2025
· release notes
ZIA adds custom Browser EUN templates for File Type Control and Microsoft IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support for 3rd-Party App Governance
Adds Browser Notification Template field to File Type Control rule configuration in the ZIA Admin Portal to display custom notifications on endpoints when access is blocked or cautioned. Adds support for Microsoft as an Identity Provider (IdP) in the 3rd-Party App Governance Admin Portal to authenticate admins and users for Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. connections.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-06-23
Jun 23, 2025
· release notes
New STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. VM PSE image available for Nutanix on ZPA
Deception — Release Upgrade Summary (2025) — 2025-06-23
Jun 23, 2025
· release notes
Zscaler Deception adds Gen AI adaptive decoys, Azure integration, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, and macOS agent customization.
Deploys Gen AI adaptive decoys that dynamically adjust responses using generative AI Creates Generative AI decoys in Microsoft Azure using OpenAI models Configures IPv6-enabled subnets/VLANs and deploys Internal decoys with dual-stack support
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-23
Jun 23, 2025
· release notes
ZIA adds custom EUNs to File Type Control policies and a Bandwidth by Data Center filter to Web Insights.
Adds Browser Notification Template field in the Add File Type Control Rule window for block/caution rules
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-06-20
Jun 20, 2025
· release notes
Workflow Automation adds configurable hourly, daily, or weekly user digest notification frequency in Account Settings.
Adds frequency setting (Hourly, Daily, or Weekly) for user digest notifications in the Data Protection integration.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-06-20
Jun 20, 2025
· release notes
Adds companion probe pairing in Zscaler Hosted probes to run Cloud Path probes alongside Web probes
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-20
Jun 20, 2025
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macro support, NSS feed app filtering, Zoom tenant support, Browser Control API, and Sandbox token limits.
Adds ${DEPARTMENT}, ${FILESIZE}, and ${REFERRER_URL} inline web DLP macros for notification templates Adds webApplicationsExclude and nwApplicationsExclude attributes to the ZmanageNssFeed model in the /nssFeeds API endpoints Adds support for configuring Zoom as a SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Application Tenant for Data at Rest Scanning policies Adds GET /browserControlSettings and PUT /browserControlSettings endpoints to the Browser Control Policy API category Adds new ML-based DLP dictionaries for ID Card, Medical Imaging, Satellite Data, and Schematic Data detection
+5 more
show less
Adds Endpoint DLP support for predefined dictionaries: CNPJ Number (Brazil), Mexico Unique Population Registration Code, National Economic Registry Number (Poland), Personal Identification Number (Croatia), and Unique Master Citizen Number Adds fetchLocations query parameter to the GET /locations/groups endpoint to retrieve associated locations Adds new Allowlist support for URLs and MD5 file hashes in Advanced Threat Protection (ATP) Supports up to 5 Sandbox API Tokens with filtering by Sandbox API Key Name in Web Insight Logs Enables custom, client-side connector onboarding for Salesforce using a minimum set of credentials
10 details in Everything
└──▷ BREAKING ON UPGRADE
! The CSV import format for Custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signature rules now requires comma-separated values to be enclosed in three single quotes (''') instead of double quotes (")
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-18
Jun 18, 2025
· release notes
ZIA extends tenancy restriction support to the Amazon Web Services CLI.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-16
Jun 16, 2025
· release notes
ZIA adds AWS CLI tenancy support, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user lookup for outbound email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and NSS feed fields
Adds Tenancy Restriction support for Amazon Web Services CLI via Tenant Profiles. Adds SCIM-based user lookup to Zscaler Outbound Email DLP to map email addresses with ZIA login names. Allows the %s{sender} field in NSS Feed Output Format for Email DLP logs.
3 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-06-16
Jun 16, 2025
· release notes
Risk360 adds support for Gen AI Risk Factors to quantify user data privacy and sensitive data loss risks.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-13
Jun 13, 2025
· release notes
ZIA adds Dedicated IP/Geo IP forwarding, Zoom/Workday/Webex SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. support, ATP allowlisting, and new API endpoints.
GET /dedicatedIPGateways/lite endpoint added to retrieve dedicated IP gatewayswebApplicationsExclude and nwApplicationsExclude attributes added to ZmanageNssFeed model for excluding applications in NSS feedsfetchLocations query parameter added to GET /locations/groups endpoint to fetch associated locationsNew Dedicated IP forwarding method available in ZIA forwarding policies to use provisioned source IPs New Geo IP forwarding method available in ZIA forwarding policies to map source IPs to traffic origin country
+10 more
show less
New Dedicated IP page in Administration menu with Gateways and IP Addresses tabs for managing dedicated IP resources Sandbox API Token Support allows up to 5 tokens with a 10-character name limitWeb Insight Logs can now be filtered by API Key Name column category Advanced Threat Protection (ATP) now supports adding URLs and MD5 file hashes to an Allowlist SSPM Scan checkbox added for onboarding Workday tenants with Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. SSPM Scan checkbox added for onboarding Webex Teams tenants with Advanced SSPMSaaS Security Data at Rest Scanning policies now support Zoom tenant configuration Quarantine Tombstone Template can be selected when quarantining files in the Assets Report Default limit for File Type Control Policy rules increased to 2,048 from 1,024 GET /browserControlSettings and PUT /browserControlSettings endpoints added for Browser Control Policy management
15 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-06-12
Jun 12, 2025
· release notes
ZPA adds GCE GCE Google Compute Engine, Google's infrastructure-as-a-service platform for running virtual machines in the cloud; cyber tools use it for scalable, on-demand compute without managing physical hardware. support for agent groups and a Microsegmentation Overview Dashboard with new widgets
Adds Agent Admin Status inheritance display to show whether the setting is inherited from the agent group or set individually at the agent level Adds Google Compute Engine metadata discovery (cloud region, project name, VPC VPC A logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. name) for agents in Microsegmentation agent groups Adds a new Microsegmentation Overview Dashboard containing Protected-to-Unprotected Resources and Protected-to-Unprotected Resource Groups widgets
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-11
Jun 11, 2025
· release notes
ZIA adds Gen AI prompt configuration for Writer and Deepseek via new API fields.
Adds enableDeepSeekPrompt and enableWriterPrompt Boolean fields to the AdvancedUrlFilteringCloudAppOptions model in the /advancedUrlFilterAndCloudAppSettings API endpoint Extends Gen AI prompt configuration capabilities to the Writer and Deepseek generative AI applications for categorization and storage
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-10
Jun 10, 2025
· release notes
ZIA adds Gen AI prompt configuration for Writer and Deepseek via new API fields and policy settings.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-06-09
Jun 9, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Data Analyst role, AI Security tab dashboard, data duplication detection, AWS evidence/timeline, new posture policies, and unmanaged DB scanning.
Adds the Data Analyst predefined DSPM role for users who need access to evidence data displayed on the Evidence tab Adds an AI Security tab to the DSPM dashboard providing insights into generative AI services accessing sensitive data stores, including total AI services deployed, accessible data stores, exposed sensitive data volume, accessible files/tables, and open alerts Adds a Data Duplications page that detects duplicate files and displays details for corrective action to reduce attack surface attack surface The exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. Adds Evidence generation for sensitive data findings (currently for AWS resources) allowing validation against DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines and dictionaries, and a Timeline tab on the Data Inventory page for AWS data stores showing configuration change history Adds new data posture policies for AWS (including EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , RDS, S3, Bedrock/Knowledge Base), Azure (including PostgreSQL, AI Foundry Hub), and GCP (Cloud SQL/MySQL/MS SQL) covering encryption, access control, logging, and recovery misconfigurations
5 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-06-06
Jun 6, 2025
· release notes
ZDX adds alerting for any incident type and Call Quality metrics, a Software Patch Inventory view, and UCaaS/ZPA score analysis.
Adds alert support for any incident type to automatically notify on impacted devices Adds alert support for Call Quality metrics via rule type selection for UCaaS applications Introduces Software Patch Inventory to identify software patch distribution across user devices Enables ZDX Score Analysis on User Details page for UCaaS and Zscaler Private Access (ZPA) applications
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-06
Jun 6, 2025
· release notes
ZIA adds Gen AI prompt config for Writer/Deepseek/Grok, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. user lookup for Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and Webex SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support
webApplicationsExclude and nwApplicationsExclude attributes added to ZmanageNssFeed model in /nssFeeds API to exclude specific applications from NSS logsfetchLocations query parameter added to GET /locations/groups endpoint to fetch associated locations for a groupenableDeepSeekPrompt and enableWriterPrompt Boolean fields added to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIenableGrokPrompt Boolean field added to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APISCIM-based user lookup support for Zscaler Outbound Email DLP to map email addresses with ZIA login names
+5 more
show less
%s{sender} field added to NSS and Cloud NSS feed output format for Email DLP logsDefault limit for File Type Control Policy rules increased to 2,048 Support for Zoom as a tenant in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP and Malware policies Tombstone Template selection added when quarantining files to user root folder in Assets Report SSPM Scan support for Webex Teams tenants in SaaS Security Posture Management
10 details in Everything
└──▷ BREAKING ON UPGRADE
! CSV import for Custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signature rules now requires three single quotes (e.g., ''') instead of double quotes (") to enclose comma-separated values
Workflow Automation — Release Upgrade Summary (2025) — 2025-06-05
Jun 5, 2025
· release notes
Workflow Automation enhances incident management with frozen column headers and refined sorting options on the Incidents page
Incident table column headings are now frozen (always visible) when scrolling through multiple pages of incidents Incident sorting is restricted to specific attribute columns, excluding Transaction ID, Last Change Date, Source DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Type, Labels, Status, Engine, Dictionary, Rule, Dictionary Match Count, Action, Last Change, Incident Groups, Justification Reason, Justification Note, Username, Client IP, File MD5, Home Location, Work Location, File Source Location, File Modification Time, Resolution Date, and Integration
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-06-04
Jun 4, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Data Analyst role, AI Security dashboard insights, duplicate file detection, evidence/timeline for AWS inventory, and unmanaged DB scanning.
Adds the Data Analyst predefined DSPM role for data investigation, analysis, and evidence access Introduces the AI Security tab on the DSPM dashboard with detailed insights into generative AI services accessing sensitive data Adds a Data Duplications page to detect and display details of duplicate files containing sensitive data Adds evidence data for AWS sensitive data discoveries to validate findings against DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines and dictionaries Adds a Timeline tab on the Data Inventory page for AWS data stores to view configuration and management changes
+1 more
show less
Introduces new predefined data posture policies for AWS, Azure, and GCP covering encryption, access control, AI guardrails, and backup settings
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-06-03
Jun 3, 2025
· release notes
ZPA adds API Discovery for API Protection, existing IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support in Business Continuity, automated updates, and hosting detection.
Adds API Discovery capability for API Protection to identify protected APIs automatically. Enables use of existing IdP configurations for user authentication during Business Continuity events. Adds status code SE: Timeout policy blocked access when ZPA blocks Web Browser requests due to timeout policies. Enables automatic detection or manual entry of data center hosting information for App Connectors.
4 details in Everything
Private Access (ZPA) — App Connector Release Summary (2025) — 2025-06-03
Jun 3, 2025
· release notes
ZPA App Connector adds configuration overrides for server inactivity timeouts.
Client Connector — Client Connector App Release Summary (2025) — 2025-06-03
Jun 3, 2025
· release notes
Client Connector 4.3.3 for iOS adds support for Zscaler Tunnel (Z-Tunnel) 2.0 with Digital Experience
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-06-02
Jun 2, 2025
· release notes
ZPA adds Zscaler-managed Business Continuity cloud for single-tenant disaster recovery.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-06-02
Jun 2, 2025
· release notes
ZIA adds Gen AI prompt fields for Writer/Deepseek via API and supports Zscaler-Managed Business Continuity Cloud
Added enableDeepSeekPrompt Boolean field to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIs to enable generative AI prompts with Deepseek Added enableWriterPrompt Boolean field to AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIs to enable generative AI prompts with Writer Support for Zscaler-Managed Business Continuity Cloud service using Private Policy Cache and Private PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. Server components
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-30
May 30, 2025
· release notes
ZIA adds Workday/Webex SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. , Grok prompts via API/config, file type controls, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. for email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and SharePoint site groups.
Adds enableGrokPrompt Boolean field to the AdvancedUrlFilteringCloudAppOptions model in /advancedUrlFilterAndCloudAppSettings APIs for Grok AI prompt configuration. Adds SSPM Scan checkbox onboarding support for Workday tenants via Advanced SSPM. Adds SSPM Scan checkbox onboarding support for Webex Teams tenants via Advanced SSPM. Expands File Type Control and DLP to include Appinstaller Files (.appinstaller) in the Other Documents category. Enables password-protected criteria (.pdf, Encrypted Office, ZIP, RAR, 7-Zip, etc.) for File Type Control rules and adds passwordProtected criterion to /fileTypeRules endpoints.
+6 more
show less
Enables microphone and camera functionality for users in isolated browser profiles when Turbo Mode is enabled. Adds SCIM-based user lookup support for Zscaler Outbound Email DLP to map email addresses with ZIA login names. Adds %s{sender} field to NSS/CloudNSS Feed Output Format for Email DLP logs. Supports DLP policy rules without content inspection for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Data at Rest Scanning. Adds Site and Site Groups management (view, add, edit, bulk upload via CSV up to 10,000 sites/group) for SharePoint tenants in SaaS Application Tenants and DLP policies. Supports unified onboarding, editing, and deletion of SaaS application tenants with 3rd-Party App Governance or Advanced SSPM from the ZIA Admin Portal.
11 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-28
May 28, 2025
· release notes
ZPA adds client platform and hostname fields to LSS logs and Cloud Service API
platform and hostname fields added to User Activity transaction logs in Log Streaming Service (LSS)platform and hostname fields returned by the format key when managing LSS configurations via the ZPA Cloud Service API
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-28
May 28, 2025
· release notes
ZIA adds Dedicated IP and Geolocalization IP forwarding methods with new API endpoint
Adds Dedicated IP and Geolocalization IP to Forwarding Policy traffic routing options for source-IP-based access control Adds GET /dedicatedIPGateways/lite endpoint to retrieve dedicated IP gateway lists via the Cloud Service API Adds Bandwidth by Data Center filter to Web Insights for bandwidth analysis granularity
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-27
May 27, 2025
· release notes
ZIA adds unified onboarding of SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. app tenants to Admin Portal and new Web Insights Bandwidth by Data Center filter
Adds ability to onboard, edit, and delete new SaaS application tenants enabled with 3rd-Party App Governance or Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. directly from the Add SaaS Application Tenant page in the ZIA Admin Portal
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-26
May 26, 2025
· release notes
ZIA adds risk explainability to 3rd-Party App Governance and Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. via hover tooltips.
Adds ability to view breakdown of app risk score by hovering over the risk score in the App Panel header Adds ability to view breakdown of control severity level by hovering over the severity in the Control Panel header
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-23
May 23, 2025
· release notes
Adds STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -compliant RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 Private Service Edge image for Nutanix deployments.
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-05-23
May 23, 2025
· release notes
Adds support for applying security policies via Azure user-defined tags and attributes in Limited Availability.
Client Connector — Release Upgrade Summary (2025) — 2025-05-23
May 23, 2025
· release notes
Zscaler Client Connector 4.4.1 adds Device Events dashboard, Linux Telemetry option, and Disable Reasons API export.
Adds a Device Events dashboard displaying ZIA and ZPA service status and statistics on users turning off services via passwords Supports a new endpoint in the Zscaler Client Connector API to download or export the Disable Reasons report under enrolled devices Adds a Device Upgrade Status section to the Zscaler Client Connector Registered Device Details window that displays the status of an in-progress upgrade Updates the Zscaler Client Connector Portal to support using device groups with app profiles for Authentication Service users
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-23
May 23, 2025
· release notes
ZIA adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. lookup, password-protected file rules, isolation mic/cam, site group DLP, and extensive cloud API endpoints.
POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, DELETE /cloudApplicationInstances/{instanceId} for managing cloud application instances via API/fileTypeRules API now supports the passwordProtected rule criterionGET /users API rate limit updated to 10 calls/minute and 40 calls/hourNew API categories: Alerts, Bandwidth Control & Classes, Cloud Nanolog Streaming Service, Forwarding Control Policy, FTP Control Policy, Mobile Malware Protection Policy, Time Intervals, Admin & Role Management, Cloud Applications, NAT Control Policy, Firewall Policies, Cloud App Control Policies, and Service Edges GET /virtualZenClusters, POST /virtualZenClusters, PUT /virtualZenClusters/{virtualZenClusterId}, DELETE /virtualZenClusters/{virtualZenClusterId} for managing Virtual Service Edge clusters
+20 more
show less
New API endpoints for alert subscriptions: GET /alertSubscriptions, POST /alertSubscriptions, GET /alertSubscriptions/{alertSubscriptionId}, PUT /alertSubscriptions/{alertSubscriptionId} New API endpoints for bandwidth control rules: GET/POST/PUT/DELETE /bandwidthControlRules and /lite variants New API endpoints for bandwidth classes: GET/POST/PUT/DELETE /bandwidthClasses and /lite variants New API endpoints for NSS servers: GET/POST/PUT/DELETE /nssServers New API endpoints for mobile malware protection: GET/PUT /mobileAdvanceThreatSettings New API endpoints for FTP control settings: GET/PUT /ftpSettings New API endpoints for third-party proxies: GET/POST/PUT/DELETE /proxies and /lite variants New API endpoints for time intervals: GET/POST/PUT/DELETE /timeIntervals New API endpoints for password expiry settings: GET/PUT /passwordExpiry/settings New API endpoints for cloud application risk profiles: GET/POST/PUT/DELETE /riskProfiles and /lite variants New API endpoints for DNAT control policies: GET/POST/PUT/DELETE /dnatRules New API endpoints for DNS Gateways: GET/POST/PUT/DELETE /dnsGateways and /lite variants New API endpoints for tenant profiles: GET/POST/PUT/DELETE /tenancyRestrictionProfile SCIM-based user lookup added to Zscaler Outbound Email DLP for mapping email addresses to ZIA login names %s{sender} field available in Feed Output Format for NSS or Cloud NSS feed configuration of Email DLP logsFile Type Control and DLP now supports .appinstaller file type in the Other Documents category File Type Control rules can now be configured based on Password-Protected criteria for PDF, Encrypted Office Docs, ZIP, RAR, 7-Zip, ZIP w/Suspicious Script, and Zipx formats Isolation profiles now support microphone and camera functionality if Turbo Mode is enabled SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP policies can be created without content matchingSaaS Application Tenants manages SharePoint Sites and Site Groups; Data at Rest Scanning DLP supports Sites (up to 1,024) or Site Groups (include/exclude up to 256)
25 details in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-05-22
May 22, 2025
· release notes
Adds user-defined tag support for filtering applications and contracts in Business Insights
Adds Application Tags feature to link applications to user-defined tags for filtering Adds Contract Tags feature to link contracts to user-defined tags for filtering
2 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-05-22
May 22, 2025
· release notes
Adds Risk Management Mitigation Strategy Report download and support for 5 Deception risk factors.
Adds Internal Decoys Deployed , Zero Trust Network Decoys Deployed , Active Directory Decoys Deployed , Threat Intelligence Decoys Deployed , and Endpoint Deception Deployed as supported deception risk factors
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-21
May 21, 2025
· release notes
ZIA adds Zoom controls via Tenant Profiles and Instance Discovery Report enhancements for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. visibility.
Adds support for Zoom in Tenant Profiles to control actions like file transfer and recording Adds Domain, Tenant, Site, and Workspace levels to the Instance Discovery Report
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-20
May 20, 2025
· release notes
ZPA adds privileged credentials analytics and approval request management in the Admin Portal.
Adds Credentials Diagnostics page to view analytics for privileged remote access (PRA) including total credentials, active usage, and breakdown by protocol type Adds ability to approve or reject PRA approval requests directly from the ZPA Admin Portal without switching to the PRA Portal Updates page name from Requests Diagnostics to Approval Requests Diagnostics for PRA workflows Enables Markdown format support when creating Acceptable Use Policies (AUP)
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-19
May 19, 2025
· release notes
Allows disabling the Pop-Up Message to User field in access policy rule actions.
Client Connector — Release Upgrade Summary (2025) — 2025-05-16
May 16, 2025
· release notes
Zscaler Client Connector Portal 4.4.1 adds Device Events dashboard, Linux App Profile telemetry, and an API export endpoint for Disable Reasons.
Adds a Device Events dashboard that displays ZIA and ZPA service status and statistics about users turning off the services via passwords Adds the Zscaler Client Connector Telemetry option in App Profiles for Linux Supports a new endpoint in the Zscaler Client Connector API to download or export the Disable Reasons report under enrolled devices Adds a Device Upgrade Status section to the Zscaler Client Connector Registered Device Details window that displays the status of an in-progress upgrade Updates the Zscaler Client Connector Portal to support using device groups with app profiles for Authentication Service users
5 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-05-16
May 16, 2025
· release notes
ZDX adds macOS Hi-Fi Cloud Path Diagnostics support and Wi-Fi dashboard metric configuration.
Adds macOS support for Hi-Fi Cloud Path Diagnostics Sessions via ZDX Admin Portal (requires Client Connector >=4.5.1 and ZDX Module >=4.4) Adds Wi-Fi Dashboard Enhancements allowing view of impacted Wi-Fi access points Adds configuration option in Inventory Settings to use signal strength and retransmission rate instead of ZDX Score for low-performing Wi-Fi devices
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-16
May 16, 2025
· release notes
ZIA adds HTTP Header Control profiles, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for .appinstaller/password-protected files, Site Group support in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security, and extensive Cloud Service API endpoints.
Adds passwordProtected criterion to the /fileTypeRules API endpoint for File Type Control and DLP Adds GET /alertSubscriptions, POST /alertSubscriptions, PUT /alertSubscriptions/{alertSubscriptionId} endpoints for managing alert subscriptions via Cloud Service API Adds POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, DELETE /cloudApplicationInstances/{instanceId} endpoints for cloud application instance management Adds HTTP Header Profile and HTTP Header Insertion Profile in the ZIA Admin Portal for URL filtering based on HTTP headers Adds Site Group management in SaaS Application Tenants with bulk upload via CSV and support for up to 10,000 sites per group
+5 more
show less
Adds DLP policy rules without content inspection for SaaS Security Data at Rest Scanning Expands File Type Control and DLP to support .appinstaller file types in the Other Documents category Adds GET /users rate limit of 10 calls/minute and 40 calls/hour in the Cloud Service API Deprecates Trigger Multi-Factor Authentication action in UEBA Alert rules, leaving only Trigger an Alert or Place user in group options Adds passwordProtected field support for PDF, Encrypted Office Documents, ZIP, RAR, 7-Zip, ZIP w/Suspicious Script, and Zipx formats in File Type Control
10 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-15
May 15, 2025
· release notes
New ZPA Cloud Service API endpoints for admin, role, client settings, app provisioning, and cert generation
Adds GET /mgmtconfig/v1/admin/customers/{customerId}/administrators/{adminId} and related admin CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints to the ZPA cloud service API. Adds POST /mgmtconfig/v1/admin/customers/{customerId}/roles, PUT .../roles/{roleId}, and DELETE .../roles/{roleId} for programmatic role management. Adds POST /mgmtconfig/v1/admin/customers/{customerId}/clientSetting and related endpoints for managing client settings via API. Adds POST /mgmtconfig/v1/admin/customers/{customerId}/application/provision to provision applications with all related objects. Adds POST /mgmtconfig/v1/admin/customers/{customerId}/enrollmentCert/selfsigned/generate and POST .../enrollmentCert/csr/generate for certificate generation.
5 details in Everything
Private Access (ZPA) — App Connector Release Summary (2025) — 2025-05-15
May 15, 2025
· release notes
App Connector 25.42.9 adds configuration overrides for server inactivity timeouts (slow and fast).
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-14
May 14, 2025
· release notes
ZIA adds HTTP Header Control policies and C2 traffic alerts; ChatGPT tenant profiles extended across clouds
Adds HTTP Header Profile and HTTP Header Insertion Profile types to create URL Filtering policy rules based on HTTP headers Enables default alerts for unknown or suspicious C2 traffic via Advanced Threat Protection Policy configuration Extends Tenant Profiles feature to the ChatGPT application to provide access to specific workspace IDs
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-13
May 13, 2025
· release notes
ZIA adds Nearby Sharing restriction, CSV inventory export, persistent columns, HTTP Header Control profiles, and unknown C2 alerts.
Adds Nearby Sharing rule in Analytics > Endpoint Data Scan > Device Control to restrict or block Bluetooth, AirDrop, Nearby Share, Phone Link, Universal Clipboard, iPhone Sync & Mirroring file transfers Adds CSV export for inventory data (removable storage devices and printers) from the Inventory page Adds persistent column selections and resizing preferences on Endpoint Data Scan pages across zia platforms Adds HTTP Header Profile in Administration > HTTP Header Control to create URL Filtering policy rules based on HTTP headers Adds HTTP Header Insertion Profile in Administration > HTTP Header Control > HTTP Header Insertion Profile for header manipulation
+2 more
show less
Adds filters and columns for HTTP Header Profile and HTTP Header Insertion Profile to Web Insights Logs Adds default alert for unknown and suspicious C2 traffic via Configuring the Advanced Threat Protection Policy on zscalertwo.net
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-12
May 12, 2025
· release notes
ZIA adds HTTP Header Control for URL filtering policies and alerts for unknown C2 traffic
Adds HTTP Header Profile to Administration > HTTP Header Control in the Admin Portal Adds HTTP Header Insertion Profile to Administration > HTTP Header Control > HTTP Header Insertion Profile in the Admin Portal Enables alerts for unknown or suspicious C2 traffic (enabled by default) Adds new filters and columns for HTTP Header profiles in Web Insights Logs
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-09
May 9, 2025
· release notes
ZPA updates OWASP OWASP A nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. predefined controls to support version OWASP_CRS/4.8.0
Adds support for OWASP_CRS/4.8.0 in OWASP predefined controls, becoming the default on the OWASP Predefined Controls page and AppProtection Profiles page Raises event priority to High for Last Component Disconnected events for App Connectors and ZPA Private Service Edges
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-09
May 9, 2025
· release notes
ZIA adds C2 traffic alerts, WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. protocol support, cloud application instance API endpoints, and granular admin role permissions.
Adds POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, and DELETE /cloudApplicationInstances/{instanceId} endpoints for programmatic management of cloud app instances Enables alerts for unknown or suspicious C2 traffic, available by default in Advanced Threat Protection Policy configuration Adds passwordProtected criterion to /fileTypeRules API and File Type Control UI for handling encrypted PDF, Office, ZIP, RAR, 7-Zip, and Zipx files Adds WebSocket and WebSocket SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS as selectable protocol types in DLP rules, specifically supporting Microsoft Copilot application monitoring Extends Admin Role Management to allow field-wise permissions (Full, View Only, None) for individual ZIA features across Admin Portal and API roles
+2 more
show less
Enables microphone and camera functionality in Isolation Profiles when Turbo Mode is enabled Adds Instance Discovery Report visibility for Domain, Tenant, Site, and Workspace instance types across Google Drive, Gmail, Box, OneDrive, Microsoft Outlook, Microsoft Teams, Salesforce, ServiceNow, SharePoint, Slack, and GCP
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The Trigger Multi-Factor Authentication action under Adding Alert Rule for UEBA Alert is deprecated and alert triggers with Multi-Factor Authentication are no longer supported
Risk360 — Release Upgrade Summary (2025) — 2025-05-09
May 9, 2025
· release notes
Zscaler Risk360 allows users to override computed breach probabilities via a new simulation toggle.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-08
May 8, 2025
· release notes
ZPA adds ML-based Microsegmentation Managed Resource Group audit logs and API key counts per role
Adds Microsegmentation Managed Recommended Resource Group to Audit Logs for tracking ML-recommended resource group changes Adds a new column to the Roles page showing the number of API keys associated with each assigned role
2 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-05-08
May 8, 2025
· release notes
DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Incident filters now support case-insensitive matching, hostnames for URL fields, and multi-string AND logic.
Referrer URL and URL incident filters now accept complete host names (e.g., www.jumpshare.com) in addition to full URLs.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-05-07
May 7, 2025
· release notes
ZPA Private Access May 2025 adds Microsegmentation audit log type and dedicated Network Connector RPM
Adds a new Microsegmentation Managed Recommended Resource Group resource type to Audit Logs for microsegmentation changes Releases a dedicated Network Connector RPM package (replacing the dependency bundle within the App Connector RPM) Enables App Connectors to remove Network Connector dependencies via yum upgrade
3 details in Everything
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-05-07
May 7, 2025
· release notes
EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. introduces automatic Approved status for verified assets discovered during onboarding.
Automatically updates asset status from Candidate to Approved upon successful verification
1 detail in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-05-07
May 7, 2025
· release notes
Client Connector 4.5.0.238 for macOS adds keychain operation timeouts and fixes several posture/switching issues.
Adds a timeout to keychain operations for some APIs.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-05-07
May 7, 2025
· release notes
ZDX now integrates with OneAPI; ZDX API keys sync to Authentication Service Admin Portal for eligible tenants.
Adds ZDX API support in OneAPI allowing synchronization of credentials for Authentication Service-enabled tenants Exposes ZDX API keys, created in the Authentication Service Admin Portal , as read-only on the API Keys page in the ZDX Admin Portal
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-05-07
May 7, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS subset onboarding, GCP VNet VNet A private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. embedding embedding Lists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. , unmanaged DB access tabs, AI service scanning, and custom predicates.
AWS Services selection during onboarding allows monitoring only specified services (e.g., Storage bucket) with minimal permissionsGCP account onboarding now accepts Custom Network Settings for orchestrator and scanner services to embed them in existing networks Compliance Dashboard now displays counts of failed policies and resources per control category for each framework Dashboard includes AI Services Widget monitoring AWS Bedrock Knowledge Bases and Agents, and an AI Models tab Access Tab added to Data Inventory for unmanaged databases (e.g., MSSQL, PostgreSQL) showing privileges, users, and roles
+5 more
show less
Data Inventory now displays graph for AWS Bedrock Knowledge Base linking sensitive data stores to agents on the Risk Explorer tab 18 new Data Posture Policies for AWS, Azure, and GCP (e.g., unmanaged SQL audit logging, Bedrock guardrails, Cloud SQL deletion protection) Support for scanning GCP Compute Engines including disks, posture, and access checks on Dashboard and Data Inventory On-Premises Database Scanning enabled for MSSQL via remote agentless scans in private/public data centersNew predicates: Can be accessed by (unmanaged PostgreSQL), Has Entitlement , Has Access to (GCP Compute VM), Exposed to AI service
10 details in Everything
Client Connector — ZDX Module Release Summary (2025) — 2025-05-06
May 6, 2025
· release notes
ZDX Module 4.4 for macOS adds PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. handling, Z-Tunnel DNAT support, and improved Cloud Path logic.
Adds handling of personally identifiable information (PII) for new features Adds support in Cloud Path where the traffic is sent through the tunnel and bypassed through the Application Profile PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. Supports Destination Network Address Translation (DNAT) topology in Zscaler Internet Access (ZIA) Z-Tunnel 1.0 mode
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-05-05
May 5, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS Bedrock/Agents monitoring, unmanaged DB access analysis, GCP Compute scanning, and new policy predicates
Adds AWS Bedrock Knowledge Bases and AWS Bedrock Agents as monitored primary data stores with dedicated AI Services Widget, Data Inventory, Risk Explorer graph, and policy checks. Adds AI Models tab on the DSPM dashboard to summarize models in use across AI services and detect risky/un-sanctioned models. Adds Access tab for unmanaged databases (MSSQL, PostgreSQL) in Data Inventory showing privilege aggregation, privileged users, and potential security issues. Adds support for scanning GCP Compute Engines (VM disks) with classification, misconfiguration, vulnerability, access, and entitlement checks via custom policies and investigation queries. Adds on-premises database scanning support for MSSQL using agentless remote scans against private/public data center objects.
+6 more
show less
Adds cloud account onboarding enhancements allowing selective AWS service subsets during onboarding to enforce minimal permissions. Adds GCP account onboarding option to embed orchestrator and scanner services in existing network settings instead of automatic defaults. Compliance Dashboard now shows the number of failed policies and resources per control category for each compliance framework. New data posture policies added for AWS (e.g., Unmanaged AWS Microsoft SQL server does not have audit logging , S3 bucket containing sensitive data is encrypted with a KMS key that does not belong to AWS organization ), Azure AI Foundry Hub, and GCP Cloud SQL. Adds relationship predicates for investigation/policy queries: Can be accessed by for unmanaged PostgreSQL; Has Entitlement , Has Access to , Can be accessed by for GCP Compute VM. Adds Exposed to AI service predicate to check storage accounts containing sensitive data exposed to AI services.
11 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-05-02
May 2, 2025
· release notes
ZIA adds granular admin role permissions, instance discovery levels, and extensive new Cloud Service API endpoints
Admins can assign field-wise permissions (Full, View Only, None) via Administration > Role Management for ZIA features, SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. partner roles, and API roles Instance Discovery Report now supports Google Drive, Gmail, Box, OneDrive, Microsoft Outlook, Microsoft Teams, Salesforce, ServiceNow (Level 1), SharePoint, Slack (Level 2), and GCP (Level 3) with Domain, Tenant, Site, and Workspace instance types New Cloud Service API endpoints for cloud application instances: POST /cloudApplicationInstances, PUT /cloudApplicationInstances/{instanceId}, DELETE /cloudApplicationInstances/{instanceId} GET /users rate limit updated to 10 calls/minute and 40 calls/hour New Cloud Service API categories and endpoints added for Alerts, Bandwidth Control & Classes, Cloud Nanolog Streaming Service, Forwarding Control Policy, FTP Control Policy, Mobile Malware Protection Policy, Time Intervals, Admin & Role Management, Cloud Applications, NAT Control Policy, Firewall Policies, and Cloud App Control Policies
+1 more
show less
New Virtual Service Edge cluster endpoints: GET /virtualZenClusters, POST /virtualZenClusters, GET /virtualZenClusters/{virtualZenClusterId}, PUT /virtualZenClusters/{virtualZenClusterId}, DELETE /virtualZenClusters/{virtualZenClusterId}
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The Sandbox Scanning Portal URL changed to HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. at https://filecheck.zscaler.com/; previous bookmarks no longer work
Breach Predictor — Release Upgrade Summary (2025) — 2025-05-01
May 1, 2025
· release notes
Breach Predictor adds company logos to findings/events UI and expands policy recommendations to File Type Control and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection.
Adds company logos to the Findings page (Attack Path tab) and Events page in the Zscaler Breach Predictor Portal to identify log sources for threat data Expands Policy Recommendations on the Threat page to include File Type Control and SSL Inspection policies alongside Sandbox and URL Filtering
2 details in Everything
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-05-01
May 1, 2025
· release notes
EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds an asset discovery chain on the Asset Details page to trace asset connections and attestation.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-04-30
Apr 30, 2025
· release notes
ZPA adds Chrome Enterprise browser diagnostics and posture profiles, ML-based resource group recommendations, and new VMware connector/controller images.
Adds Chrome Enterprise Browser Diagnostics page to view analytics and policy log data for Chrome Enterprise browsers Enables evaluation of access using Chrome Posture Profiles to leverage device posture signals (Browser Version, OS, Firewall status) in ZPA Browser Access and Browser Isolation Adds new widgets to the Microsegmentation Flow dashboard for blocked flow records and categories like Top Blocked Talkers, Top Blocked Listeners, and Agent-to-Agent Agent-to-Agent Agent2Agent, an open protocol started by Google for AI agents from different vendors to discover each other, delegate tasks and exchange results. It complements MCP, which connects an agent to tools. Flows Adds ML-based recommendations with Confidence Scores for configuring resource groups in Microsegmentation Adds a new Network Connector image for VMware platforms
5 details in Everything
Client Connector — ZDX Module Release Summary (2025) — 2025-04-30
Apr 30, 2025
· release notes
ZDX Module 4.5 adds Npcap auto-install, 60min PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. duration, GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. /IPsec IPsec A suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. Hi-Fi Cloud Path support.
Adds automatic installation of Nmap Packet Capture (Npcap) if it is not already installed when Cloud Path starts Extends the packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. (PCAP) duration selection to 60 minutes Supports Hi-Fi Cloud Path to Zscaler Internet Access (ZIA) Public Service Edge through the Generic Routing Encapsulation (GRE) and Internet Protocol Security (IPSec) tunnel
3 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-04-30
Apr 30, 2025
· release notes
Client Connector 4.5.1.101 adds transparent proxy traffic support, packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. enhancements, and run diagnostics feature for macOS.
Adds Transparent Proxy-based Traffic interception support to the client connector app profile Enhances packet capture functionality with new capture options for session length, file size, frame size limits, and capture filters Adds Run Zscaler Diagnostics feature that allows a one-time snapshot of the system's network state for troubleshooting Enables health metrics collection by default, including support for end-to-end diagnostics
4 details in Everything
Zero Trust Branch — Release Upgrade Summary (2025) — 2025-04-30
Apr 30, 2025
· release notes
ZTB 8.0.1 adds ZIA location provisioning, OSPF, routed tunnels, WAN link selection, and App Connector support.
Adds support for creating ZIA locations from the Zero Trust Branch Admin Portal to streamline provisioning. Adds default and custom template support for ZT400 and ZT600 devices. Enables OSPF on LAN and WAN interfaces for dynamic routing. Supports routed branch-to-hub tunnels for source IP visibility in applications. Introduces App Connector capability for zero trust connectivity to private apps in sites/data centers.
+4 more
show less
Adds destination-based routing policies forwarding select traffic to ZIA-IPSec, ZIA-GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. , ZPA, or routed tunnels. Enables WAN link selection with None , Best Link , and Load Balanced modes on WAN interfaces. Adds SNMPv3 support for platform monitoring. Enhances Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. integration to support multiple domain controllers and query strings.
9 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-04-29
Apr 29, 2025
· release notes
Zscaler Client Connector 4.7 adds alternative cloud name detection by ZIA edge, step-up auth for conditional access, and log fetch automation.
Adds the ability to base alternative cloud name detection on the Zscaler Internet Access (ZIA) Public Service Edge location rather than the client location, supporting distinct names per ZIA edge Supports step-up authentication for conditional access to ZIA based on dynamic requests for Authentication Service-enabled tenants Adds an option to allow Zscaler to retrieve and analyze log bundles via the Enabling Auto System Info and Log Fetch feature Adds pop-up notifications to indicate when a device enters or exits Business Continuity mode Updates the Business Continuity configuration file properties to include device posture information
+2 more
show less
Supports controlling screen focus on the notification pop-up window from the Zscaler Notification Framework Allows restricting ZPA partner logins to specify which partners can access your organization’s tenant
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-29
Apr 29, 2025
· release notes
ZIA adds email notifications for policy triggers and a Viewer role in 3rd-Party App Governance.
Adds email notification support for 3rd-Party App Governance policies to notify users when triggered Adds a new predefined Viewer role in 3rd-Party App Governance that allows viewing data and exporting reports without making changes
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-04-28
Apr 28, 2025
· release notes
ZPA adds Application Load Balancing with weights via UI/API and Extranet connector type.
Adds Application Load Balancing feature to assign weights between server groups for high availability Adds ZPA API support for configuring application load balancing via Managing Application Load Balancing and High Availability Using API endpoint Adds Extranet as a new connector type in application segments for partner access without local App Connectors
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-04-25
Apr 25, 2025
· release notes
ZDX now supports data storage in Singapore, expanding available geographic regions for log retention alongside US, EU, and Australia.
Adds Singapore to the list of supported locations for storing ZDX logs and data.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-04-24
Apr 24, 2025
· release notes
Client Connector adds UDID logic for blank serial numbers and Safe Mode launch prevention.
Updates Zscaler Client Connector to ignore blank serial numbers when generating UDIDs, preventing multiple devices for a single user from having the same UDID. Updates Zscaler Client Connector to not launch if a user starts the device in Safe mode.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-23
Apr 23, 2025
· release notes
ZIA adds auditor email notifications for outbound email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and tenant onboarding support for external trusted domains.
Adds the ability to configure notification templates in Administration > Notification Templates > DLP to send automatic email alerts to auditors when Outbound Email DLP rules trigger Enables configuration of external trusted domains and user profiles during SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Application tenant onboarding for SaaS Security API Supports scoping SaaS Security Data at Rest Scanning DLP policies by the number of internal and external collaborators for SharePoint and OneDrive
3 details in Everything
Private Access (ZPA) — Private Cloud Controller Release Summary (2025) — 2025-04-23
Apr 23, 2025
· release notes
Private Cloud Controller 25.43.2 adds support for redirection policies using ZPA Private Service Edges over Public Service Edges.
Adds support for redirection policies that use ZPA Private Service Edges when available over ZPA Public Service Edges Updates Private Cloud Controller RPM packages for Red Hat Enterprise Linux 9.x
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-22
Apr 22, 2025
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. auditor email notifications, external trusted domains in tenant onboarding, and collaborator count scoping for file sharing.
Configures notification templates for Outbound Email DLP rule triggers Supports external trusted domains and user profiles in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API tenant onboarding
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-04-21
Apr 21, 2025
· release notes
ZPA adds Chrome Enterprise browser integration for clientless access posture enforcement
Enables granular security controls and access verification based on end-user access posture when users connect via the managed Chrome Enterprise browser. Provides visibility for users connecting via the managed Chrome Enterprise browser based on their access posture.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-04-18
Apr 18, 2025
· release notes
Cloud & Branch Connector API adds programmatic endpoints for policy resources, gateways, and ZPA segments.
Adds GET, POST, PUT, and DELETE support to /gateways endpoints for creating and deleting ZIA, Log, and Control gateways Adds programmatic management of IP groups via new GET /ipSourceGroups, GET /ipDestinationGroups, and GET /ipGroups endpoints Adds creation and update of custom network services via POST /networkServices and PUT /networkServices/{serviceid} endpoints Adds retrieval of ZPA application segments via the new GET /zpaResources/applicationSegments endpoint
4 details in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-04-18
Apr 18, 2025
· release notes
Zscaler Business Insights adds 3-month granularity option for Footfall by Time of Day analysis.
Adds 3 months time range selection for Footfall analysis in Workplace insights
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-04-18
Apr 18, 2025
· release notes
ZDX Data Explorer adds Range View format for hosted monitoring dashboards
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-18
Apr 18, 2025
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. notification templates, Talkdesk UCaaS onboarding, %s{ednsreq} field, new DLP engines, and developer tools URL category.
Adds Auditor Email Notifications feature allowing custom email triggers for Outbound Email DLP rules via Administration > Notification Templates > DLP Adds %s{ednsreq} hex-encoded FQDN field to NSS/Cloud NSS DNS log feeds Introduces Developer Tools predefined URL category under the Information Technology super category Extends UCaaS one-click configuration support to Talkdesk cloud application Adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP scope for number of internal and external collaborators in SharePoint/OneDrive policies
+4 more
show less
Allows configuring MIP labels on PowerPoint, Excel, Word, and PDF files within Data at Rest Scanning DLP rules Adds refresh icon to SaaS Security Scan Configuration page for scheduled scans Adds new tenant onboarding support for external trusted domains and users in SaaS Security API via Adding Email Profiles and Adding SaaS Application Tenants Introduces twenty-three new predefined DLP engines (e.g., CCPA, GDPR GDPR EU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. , PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. , Medical) available on Administration > DLP Dictionaries & Engines > DLP Engines
9 details in Everything
└──▷ BREAKING ON UPGRADE
! Old Policy Reason Reputation block outbound request: adware/spyware site is renamed to Not allowed to use Adware/Spyware sites ! Old Policy Reason Not allowed because URL is blacklisted is renamed to 'Not allowed because URL is placed on the denylist'! Old Policy Reason Not allowed to access internet is renamed to Block Internet Access ! Old Policy Reason 'Not allowed to browse this category, needs override' is renamed to Not allowed to browse this category ! Old Policy Reason IPS block: cryptomining & blockchain traffic is renamed to IPS block: cryptomining traffic ! Old Policy Reason 'Not allowed to upload media files to this site' is renamed to 'Not allowed to upload files to this site'! Old Policy Reason Communication with unknown servers is renamed to 'Blocked Mobile App communicating with remote unknown servers'! Old Policy Reason Communication with ad sites is renamed to 'Blocked Mobile App communicating to Ad websites'! Old Policy Reason Information identifying the device is renamed to 'Blocked Mobile App leaking Device Identifier information'! Old Policy Reason Location information leak is renamed to Blocked Mobile App leaking Location information ! Old Policy Reason Insecure user credentials is renamed to 'Blocked Mobile App leaking user credentials insecurely'! Old Policy Reason Malicious behavior is renamed to Blocked Mobile App exhibiting malicious behavior ! Old Policy Reason Personally Identifiable Information (PII) is renamed to 'Blocked Mobile App leaking Personally Identifiable Information (PII)'! Old Policy Reason Known security vulnerabilities is renamed to 'Blocked Mobile App with known security vulnerabilities'! Old Policy Reason 'Cautioned to use this Social Network site' is renamed to 'Cautioned the use of this Social Network site'! Old Policy Reason 'Cautioned to use this Streaming Media site' is renamed to Cautioned to use this Streaming/Media site ! Old Policy Reason 'Not allowed to use this Streaming Media site' is renamed to 'Not allowed to use this Streaming/Media site'! Old Policy Reason 'Unenrolled user is not allowed to establish SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. connection, use non-SSL URL to enroll' is renamed to 'Unenrolled user is not allowed to establish SSL connection'
Deception — Release Upgrade Summary (2025) — 2025-04-14
Apr 14, 2025
· release notes
Zscaler Deception adds AWS GenAI decoys, custom file decoy names, Azure multi-region support, and macOS DbVisualizer lures.
Adds Generative AI Decoys in AWS using Amazon Bedrock foundation models with interactive lure capabilities Adds ability to set Custom Names for file decoys created from preconfigured datasets Adds multiple accounts and regions support for Azure Cloud Deception deployments Adds DbVisualizer Lures for macOS endpoints in Session Lures Adds new Landmine Policy criteria: DNS Hostname (Specific) and DNS Hostname (RegEx)
+6 more
show less
Adds value restrictions to Datalist keys for Browser, Database, SSH/FTP, and Windows Credential Lure usernames (max 20) Adds Generative AI Lures Authentication option for GenAI decoy services to use deployed credentials Allows disabling Guest Accessible in Shares service to specify custom user credentials Adds bulk selection and deletion on the Policies page (Landmine > Policies) Adds ability to view specific allowlist rules that triggered a safe action on the Event Logs page Marks event or attacker as Unsafe , removing allowlist rules and flagging for investigation
11 details in Everything
└──▷ BREAKING ON UPGRADE
! Decoy Connector can no longer be used as a proxy to landmine agents.! Azure deployments require running the Azure deployment script to sync settings for health check function app.
Client Connector — Client Connector App Release Summary (2025) — 2025-04-14
Apr 14, 2025
· release notes
Zscaler Client Connector 3.10 for Android and ChromeOS adds shortcuts to Export Logs, Report an Issue, and Reauthenticate.
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-04-11
Apr 11, 2025
· release notes
Cloud & Branch Connector API gains endpoints for Policy Resources, Forwarding Gateways, and more.
Adds GET /ecRules/ecRdr, POST /ecRules/ecRdr, and PUT /ecRules/ecRdr/{ruleId} endpoints to create and update traffic forwarding rules. Adds GET /ipSourceGroups/POST /ipSourceGroups/DELETE /ipSourceGroups/{ipGroupId}, GET /ipDestinationGroups/POST /ipDestinationGroups/DELETE /ipDestinationGroups/{ipGroupId}, and GET /ipGroups/POST /ipGroups/DELETE /ipGroups/{ipGroupId} endpoints to manage IP groups programmatically. Adds GET /networkServices, POST /networkServices, PUT /networkServices/{serviceid}, and DELETE /networkServices/{serviceid} endpoints to create, update, and delete custom network services. Adds GET /zpaResources/applicationSegments endpoint to retrieve ZPA application segments for policy configuration. Adds GET /gateways, POST /gateways, and DELETE /gateways/{gatewayId} endpoints to manage ZIA and Log/Control gateways.
5 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-04-11
Apr 11, 2025
· release notes
Client Connector for macOS adds zccToForegroundDuringAuth MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. parameter to fix window disappearance during ZPA reauthentication
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-11
Apr 11, 2025
· release notes
ZIA adds Twilio/Trello SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines, /configAudit API endpoints, and Developer Tools URL category
Twilio and Trello are now supported as SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application tenants for SSPM scan (requires Advanced SSPM license).SaaS Security Data at Rest Scanning DLP policy now uses the CASB Collaborator Count field to scope rules by collaborizer count. New MIP label configuration action available in the Add DLP Rule window for PowerPoint, Excel, Word, and PDF files in Data at Rest Scanning DLP policies. GET /locations/supportedCountries endpoint added to retrieve supported countries for location configuration./adminRoles, /departments, and /groups endpoints are now limited to Zscaler OneAPI (GET operations remain on the cloud service API).
+6 more
show less
New ZIA cloud service API endpoints exclusively available via OneAPI: /configAudit, /configAudit/ipVisibility, and /configAudit/pacFile. New GET /adminUsers/me endpoint to retrieve information about the current administrator or auditor user accessing the API. Predefined URL category Developer Tools added to the Information Technology super category. Refresh icon added to the SaaS Security Scan Configuration page to refresh status of ongoing scheduled scans. New predefined DLP engines available: CCPA - High Volume, CCPA - Low Volume, Credentials and Secrets , DPDPA, Finance , FISMA - High Volume, FISMA - Low Volume, GDPR - High Volume, GDPR - Low Volume, Legal , LGPD - High Volume, LGPD - Low Volume, Medical , NIST (RMF for DoD IT) - High Volume, NIST (RMF for DoD IT) - Low Volume, PDPA - DBs, PDPA - High Volume, PDPA - Low Volume, PII (US) - High Volume, PII (US) - Low Volume, PIPEDA - DBs, PIPEDA - High Volume, and PIPEDA - Low Volume. UCaaS one-click configuration support extended to the Talkdesk cloud application.
11 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-04-10
Apr 10, 2025
· release notes
Workflow Automation adds multi-tenant ZIA incident management, Transaction ID search, and Resolution Date field
Adds Integration column to the Incidents table, filterable via the Integration field in the Filters window, allowing viewing of incidents across multiple ZIA tenants in a single Workflow Automation account. Enables searching for up to 10 incidents by Transaction ID on the Incidents page by entering IDs separated by commas. Adds a Resolution Date field to the Incident Details Overview section, incident notifications (user, escalation, user digest), and the Incident Analytics filter window.
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-04-04
Apr 4, 2025
· release notes
New Cloud & Branch Connector API endpoints for managing forwarding gateways, IP groups, network services, and ZPA segments.
Adds GET /ecRules/ecRdr, POST /ecRules/ecRdr, PUT /ecRules/ecRdr/{ruleId}, and GET /ecRules/ecRdr/count endpoints to retrieve and manage traffic forwarding rules programmatically Adds GET /ipSourceGroups, GET /ipDestinationGroups, GET /ipGroups, POST /ipSourceGroups, POST /ipDestinationGroups, POST /ipGroups, and DELETE /ip*Groups/{id} endpoints to manage source/destination IP groups and IP pools Adds GET /networkServices, POST /networkServices, PUT /networkServices/{serviceid}, and DELETE /networkServices/{serviceid} endpoints to create, update, and delete custom network services Adds GET /zpaResources/applicationSegments endpoint to retrieve available ZPA application segments Adds GET /gateways, POST /gateways, and DELETE /gateways/{gatewayId} endpoints to manage ZIA and Log/Control gateways
5 details in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-04-04
Apr 4, 2025
· release notes
Workplace reports now include real estate fields like Site ID, Lease Status and capacity data in CSV exports.
Adds new real estate columns (Site ID, Lease Status, Lease End Date, Capacity) to scheduled workplace report CSVs for Office, User, and User Aggregated Daily report types Adds HR-related columns (Employee Type, Business Group, Home Site Code, Active Status, Job Profile) to scheduled workplace report CSVs for User and User Aggregated Daily report types Adds temporal presence fields (First Seen, Last Seen) to the User Aggregated Daily workplace report CSV
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-04-04
Apr 4, 2025
· release notes
ZIA adds Developer Tools URL category, Talkdesk UCaaS one-click setup, and new OneAPI endpoints for admin/config audit.
└──▷ USE IT
Scan DNS feeds for hex-encoded domain names to detect encoded C2 channels.
Adds the Developer Tools predefined URL category under Information Technology for filtering developer sites Extends UCaaS one-click configuration support to Talkdesk cloud applications Adds MIP label support for PowerPoint files in Data at Rest Scanning DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies for file sharing apps Adds Twilio and Trello as supported SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application tenants for SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. scans requiring an Advanced SSPM license Makes the %s{ednsreq} field available in NSS/Cloud NSS DNS log feeds to output hex-encoded FQDNs
+4 more
show less
Adds support for Collaborator Count scoping criteria in SaaS Security Data at Rest Scanning DLP policies Introduces GET /locations/supportedCountries endpoint to retrieve supported countries for location configuration Introduces GET /adminUsers/me endpoint to retrieve current administrator or auditor user info Adds GET /configAudit, GET /configAudit/ipVisibility, and GET /configAudit/pacFile endpoints for System Audit Reports
9 details in Everything
└──▷ BREAKING ON UPGRADE
! /adminRoles, /departments, and /groups endpoints are now limited to OneAPI only (read-only GETs continue in ZIA cloud service API)! Newly added ZIA cloud service API endpoints like /configAudit are exclusively available via OneAPI
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-04-01
Apr 1, 2025
· release notes
ZPA adds Microsegmentation filters for resource status, flow log direction, and Ubuntu Linux support
Adds the ability to filter Microsegmentation resources by Active or Inactive status Adds Flow Log filters for traffic Direction (Inbound/Outbound) and Resource Group Name in Microsegmentation Extends Microsegmentation agent group filtering with a new Completed With Failures upgrade status option
3 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-03-31
Mar 31, 2025
· release notes
Workflow Automation adds Manager Rejected escalation type, Update Incident Group action, and multi-tab incident viewing.
Adds Manager Rejected justification type to the system default Escalation - Questionnaire Template for escalation notifications Adds Update Incident Group action on Incidents and Incident Details pages for assigning or reassigning incident groups (single or bulk) Enables viewing Incident Details for multiple incidents in separate browser tabs via right-click > Open in New Tab on the Transaction ID
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-03-31
Mar 31, 2025
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. gains ZPA support for private access
└──▷ HOW TO FIND IT
Configure a VDI template to route private traffic via ZPA instead of the public internet.
📍 Configuring VDI Templates
Set up forwarding rules for VDI sessions that require ZPA application access.
📍 Configuring VDI Forwarding Profiles
Cloud & Branch Connector — Zscaler Client Connector for VDI Release Summary (2025) — 2025-03-31
Mar 31, 2025
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. 1.5.0.5 adds registry key to prevent onboarding after reboot
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-28
Mar 28, 2025
· release notes
ZPA introduces a new operational visibility feature for App Connector health monitoring during the admin login process.
Business Insights — Release Upgrade Summary (2025) — 2025-03-28
Mar 28, 2025
· release notes
Business Insights Admin Portal reorganizes navigation for Offices and Discovered Locations pages.
└──▷ HOW TO FIND IT
Navigate to the renamed main offices list via the updated Workplace hierarchy.
📍 Workplace › Offices and Locations › Offices
Access the newly named discovered locations view in the admin portal.
📍 Workplace › Offices and Locations › Discovered Locations
Renames the Configured Offices page to Offices and moves it under Workplace > Offices and Locations > Offices Renames the Offices and Locations page to Discovered Locations under Workplace > Offices and Locations > Discovered Locations
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The Configured Offices page name is replaced by Offices in the navigation menu.! The Offices and Locations page name is replaced by Discovered Locations in the navigation menu.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-28
Mar 28, 2025
· release notes
ZIA adds Python/DPI sandbox support, hex DNS field, new audit APIs, and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries.
Adds %s{ednsreq} field to NSS and Cloud NSS feeds for hex-encoded FQDN in DNS logs Adds GET /locations/supportedCountries endpoint to retrieve supported countries for location configuration Adds GET /adminUsers/me, GET /configAudit, GET /configAudit/ipVisibility, and GET /configAudit/pacFile endpoints for admin and audit reporting Extends Zscaler Sandbox to analyze .py, .p, .pkl, .pickle, .pyd, and .pyw files Adds new predefined DLP dictionaries: National Identification Number (Chile RUN), National Identification Number (Peru CUI), and National Document ID (Uruguay)
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The /adminRoles, /departments, and /groups endpoints are now exclusively available via Zscaler OneAPI; direct access through the ZIA cloud service API is limited to GET operations only.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-27
Mar 27, 2025
· release notes
ZIA adds CASB CASB A Cloud Access Security Broker is a policy-enforcement proxy, on-premises or cloud-hosted, that sits between users and cloud services to provide visibility, compliance controls, and threat protection over SaaS and IaaS traffic. collaborator count to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scoping and a configurable EUN IP for DNS Control
Adds CASB Collaborator Count field under Special Settings of the Tenant Details page as a new scoping criteria for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Data at Rest Scanning DLP policies in file sharing applications. Enables redirection to a Zscaler-hosted EUN web page via DNS Control rules by specifying the IP 34.215.46.88 in the Redirect Response action.
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-03-27
Mar 27, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AI service posture monitoring, AWS single-account onboarding, and new investigation predicates.
Adds Exposed to AI Service posture label for data stores accessible by Azure AI Foundry Hub. Supports AWS single-account onboarding for environments restricted at the organization level. Adds Sensitive Data Triggers , Sensitive Data Matches , Sensitive Data Volume , and Last Completed Scan predicates to investigation queries. Expands supported data stores to include GCP Cloud SQL Instances, unmanaged PostgreSQL on Azure/AWS, and unmanaged MSSQL on AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. .
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-03-25
Mar 25, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI Hub detection, new posture labels, AWS single-account onboarding, expanded DB support, and investigation predicates
Detects Azure AI Foundry Hub services that access data stores containing sensitive data and displays findings in the Data Inventory graph. Applies the Exposed to AI Service posture label to data stores exposed via AI services. Supports onboarding of individual AWS single accounts for DSPM monitoring. Enhances the Compliance dashboard with failed policy counts by severity/control and lists of failed resources/policies. Adds AI Services Widget to the Dashboard showing sensitive data exposure, trigger access, and risk.
+6 more
show less
Updates Top Risk Data Stores widget See All link to navigate directly to the Data Inventory page. Displays Top Accounts and Top Data Stores widgets on the Data Discovery tab of the Dashboard. Adds new data posture policies for AWS RDS, S3, DynamoDB, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. ; Azure Storage, Key Vault, VMs, SQL/PostgreSQL; GCP storage buckets regarding GDPR GDPR EU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. /data residency. Extends AI/ML document classification to support over 100 new document types across 10 categories. Adds scanning support for Google Cloud SQL Instances (MSSQL, PostgreSQL, MySQL), unmanaged PostgreSQL on Azure/AWS, and unmanaged MSSQL on AWS EC2. Updates the Investigation Has Data predicate with Sensitive Data Triggers , Sensitive Data Matches , Sensitive Data Volume , and Last Completed Scan .
11 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-24
Mar 24, 2025
· release notes
ZPA introduces native secondary Layer 3 VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel support for legacy apps
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-21
Mar 21, 2025
· release notes
ZPA adds STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -compliant RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 images for Azure and auto-generated CA certs for AppProtection TLS inspection.
Adds Red Hat Enterprise Linux 9 App Connector and Private Service Edge VM images for Microsoft Azure that support Security Technical Implementation Guide (STIG) requirements without disabling password expiration Enables automatic certificate generation for AppProtection TLS inspection by selecting an enrollment (CA) certificate when configuring an application segment
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-03-21
Mar 21, 2025
· release notes
Cloud & Branch Connector VM now available in Microsoft Azure Marketplace for Spain Central
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-03-21
Mar 21, 2025
· release notes
ZDX adds Windows Device Incident type and a Probe Assignments system-generated report
Adds the Device incident type for Windows devices to detect anomalous behavior through usage trend analysis. Adds the Probe Assignments Report as a new system-generated report available in the ZDX Admin Portal.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-21
Mar 21, 2025
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries, granular Smart Isolation targets, Misc/Unknown URL isolation, and AWS/GCP app service groups.
Persistent State toggle added to ZIA isolation profiles to replace cookie persistenceUsers and Groups fields added to the Smart Isolate tab for granular Secure Browsing policies Preconfigured Isolation profile available for the Miscellaneous and Unknown URL category AWS and GCP application service groups added to Firewall policy for cloud traffic management
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The cookie persistence toggle in ZIA isolation profiles is renamed to Persistent State
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-19
Mar 19, 2025
· release notes
ZPA now allows users to define exceptions for OWASP OWASP A nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. controls within AppProtection profiles.
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-18
Mar 18, 2025
· release notes
New Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. type and corresponding ZPA API support for multi-session VDI environments.
Introduces Client Connector for VDI , a lightweight client type for multi-session VDI environments Adds a new client type to the ZPA cloud service API to support multi-session VDI configurations
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-03-17
Mar 17, 2025
· release notes
Zscaler Cloud & Branch Connector adds automatic fail open and custom DHCP options for physical branch devices.
Custom DHCP Options can now be added when configuring a branch configuration template for physical branch devices deployed in gateway mode.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-14
Mar 14, 2025
· release notes
STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. VM images for Nutanix and VMware now support RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 App Connector and PSE with password expiration enabled.
Nutanix STIG-hardened App Connector image (RHEL 9) available without disabling password expiration VMware STIG-hardened App Connector and Private Service Edge images (RHEL 9) available without disabling password expiration
2 details in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-03-14
Mar 14, 2025
· release notes
Zscaler Client Connector Portal 4.4 adds GPO execution in forwarding profiles, ZDX module download, ZPA partner login restrictions, and Tunnel SDK 4.3 support.
Execute GPO Update option added to the None mode in forwarding profilesAuto System Info and Log Fetch: allows Zscaler to retrieve and analyze log bundles for issue resolution Digital Experience (ZDX) Module for Windows upgrade package can be downloaded for MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or CLI deployment Fail close options for driver error or FW/AV error in App Profiles Certificate prompt handling improved via WebView2 Authentication to reduce frequency
+3 more
show less
Setting to restrict ZPA partner logins to specify which partner tenants can access your organization’s tenant Option to control screen focus for notifications from the Zscaler Notification Framework Use Tunnel SDK Version 4.3 option added for iOS support
8 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-03-14
Mar 14, 2025
· release notes
ZDX 2025 introduces SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Auto Provisioning to simplify admin group management via automated identity synchronization.
SCIM Auto Provisioning enables automatic association of user groups with ZDX Administrator Management roles and scopes.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-14
Mar 14, 2025
· release notes
ZIA adds granular Smart Browser Isolation for users/groups, new API endpoints for admin/role/dept/group mgmt, DNS block with response code action, and AWS/GCP service groups.
Adds Users and Groups fields to the Smart Isolate tab (Policy > Secure Browsing > Smart Isolate) for granular browser isolation targeting Adds BLOCK_WITH_RESPONSE action and blockResponseCode attribute in the FirewallDnsRule model to DNS Control policy via API Adds new Cloud Service API endpoints under Admin & Role Management (/adminRoles), User Management (/departments, /groups), and Traffic Forwarding (/subclouds) Adds AWS and GCP application service groups to Firewall policy for managing cloud provider traffic
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-13
Mar 13, 2025
· release notes
ZIA adds automatic dual-VM sandbox analysis (Zero Day vs Regular reports) for mitigation comparison.
Workflow Automation — Release Upgrade Summary (2025) — 2025-03-11
Mar 11, 2025
· release notes
Zscaler Workflow Automation adds DNS verification for custom email domains and resolution label requirement for closing incidents
Adds DNS record verification process for Custom Email Domains with new statuses: DNS verification pending , Expired , Failed , In Use , and Success
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-10
Mar 10, 2025
· release notes
ZPA adds microphone/camera support in isolation profiles and RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for ZPA API keys.
Adds Microphone and Camera toggle per isolation profile to enable audio/video passthrough when Turbo Mode is enabled. Enables granular Role-Based Access Control Role-Based Access Control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. (RBAC) for ZPA API operations, allowing predefined or custom roles to be assigned to API keys.
2 details in Everything
Risk360 — Release Upgrade Summary (2025) — 2025-03-10
Mar 10, 2025
· release notes
Adds ability to manage financial risk calculation settings in the Risk360 Admin Portal Account page.
Updates the existing financial risk exposure calculation method, which changes how the Loss Curve chart reflects risk exposure starting from the update date.
1 detail in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-03-07
Mar 7, 2025
· release notes
Zscaler Client Connector 4.4 adds GPO updates in None mode, ZPA tenant restriction, and log fetch options.
Adds the Execute GPO Update option to the None mode in forwarding profiles Adds an option to allow Zscaler to retrieve and analyze Zscaler Client Connector log bundles via Auto System Info and Log Fetch Adds a setting to restrict Zscaler Private Access (ZPA) partner logins to specify which partner tenants can access your organization’s tenant Adds the Lockdown on Tunnel Process Exit option updates to include tunnel crashes and the Repair App option Adds the ability to download a Digital Experience (ZDX) Module for Windows upgrade package for MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. or CLI deployment
+2 more
show less
Adds an option to control screen focus for notifications from the Zscaler Notification Framework Adds a Use Tunnel SDK Version 4.3 option to support new features introduced with Zscaler Client Connector version 4.3 for iOS
7 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-03-07
Mar 7, 2025
· release notes
ZDX adds Scattered View format for Data Explorer hosted monitoring and User Domain Settings for ServiceNow integration
Adds Scattered view format to customized Data Explorer hosted monitoring views alongside chart and tabular formats Adds User Domain Settings configuration in ZDX's ServiceNow integration to update user records based on different logins
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-03-07
Mar 7, 2025
· release notes
ZIA adds Admin/Role/User/Group API endpoints, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for LATAM nations, granular Smart Isolation controls, and DNS Block with Response Code.
GET /adminRoles, POST /adminRoles, PUT /adminRoles/{roleId}, DELETE /adminRoles/{roleId} (plus lite variants) enable programmatic management of admin roles via the Cloud Service API.GET /departments, POST /departments, PUT /departments/{departmentId}, DELETE /departments/{departmentId} (plus lite variants) allow creating, updating, and deleting departments programmatically.GET /groups, POST /groups, PUT /groups/{groupId}, DELETE /groups/{groupId} (plus lite variants) provide full CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for groups via the API.DLP now includes new predefined dictionaries: National Identification Number (Chile RUN) , National Identification Number (Peru CUI) , and National Document ID (Uruguay) .
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-05
Mar 5, 2025
· release notes
Microsegmentation Admin Config resource type added to Audit Logs in ZPA Private Access.
Deception — Release Upgrade Summary (2025) — 2025-03-05
Mar 5, 2025
· release notes
New Zscaler Deception features: Interactive AI decoy UI/API, JSON export, GuardDuty/ZPA integration, AWS multi-region, new datasets/rate limit rules.
Zscaler Deception Admin Portal now includes a theme builder for customizing the user interface of interactive generative AI decoys.Interactive generative AI decoys expose OpenAI-compatible APIs for chat completion and model retrieval. Deception events can now be exported in JSON format for analysis. New integration with Amazon GuardDuty to automatically isolate attackers by blocking their AWS access. AWS Cloud Deception supports deployment across multiple AWS accounts and regions within a single account.
+3 more
show less
New static application datasets: Grafana , BitBucket, Fortinet SSL VPN , NextCloud, VMware Aria , SAP HANA Web UI . New CVE-targeted application datasets for Journyx , Palo Alto Expedition , Apache Solr , Microsoft Exchange Server , Palo Alto PAN-OS , Apache OFBiz , SonicWall GMS, Zyxel NAS326 . QoS Rate Limit for Threat Intelligence (TI) decoys: blocks attackers generating >1,000 events for one hour and generates a QoS event with a 2-hour cooldown.
8 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-03-05
Mar 5, 2025
· release notes
Zscaler Client Connector 4.4.0.406 adds Z-Tunnel 2.0 support and improves unattended install handling.
Improves handling of unattended installs when anti-tampering is enabled
1 detail in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-03-04
Mar 4, 2025
· release notes
Client Connector adds Authentication Service SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration and IP-based bypasses for Android/ChromeOS
Adds support for the Authentication Service platform integration, enabling user authentication and registration via Single Sign-On (SSO) to access Zscaler services. Adds support for predefined and custom IP-based application bypasses to exclude routes from the VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profile for Android 13+ and ChromeOS 132+.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-03-03
Mar 3, 2025
· release notes
ZPA adds platform visibility to User Activity Logs and Extranet support on Cloud/Branch Connectors.
Adds platform field to User Activity Logs to show the OS where the Zscaler Client Connector is installed Enables Extranet Application support for ZPA Cloud Connectors and Branch Connectors
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-02-28
Feb 28, 2025
· release notes
ZPA Private Access enables Zscaler-managed certificates for Browser Access and Portals, reducing custom cert ops.
Enables publishing Browser Access applications with Zscaler-managed certificates and DNS Enables publishing user portals with Zscaler-managed certificates and DNS Enables publishing Privileged Remote Access (PRA) Portals with Zscaler-managed certificates and DNS Allows publishing links from a user portal in a PRA privileged portal for unified experience
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-28
Feb 28, 2025
· release notes
ZIA adds Admin/Role, User, Traffic Forwarding API endpoints; supports ED25519 for Incident Receiver and HTTP/2 in SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection by default.
Adds GET /adminRoles, POST /adminRoles, PUT /adminRoles/{roleId}, and DELETE /adminRoles/{roleId} to the Cloud Service API for admin role management Adds GET /departments, POST /departments, PUT /departments/{departmentId}, and DELETE /departments/{departmentId} to the Cloud Service API for department management Adds GET /groups, POST /groups, PUT /groups/{groupId}, and DELETE /groups/{groupId} to the Cloud Service API for group management Adds GET /subclouds and PUT /subclouds/{id} to the Cloud Service API for subcloud configuration Enables the Enable HTTP/2 option by default in SSL Inspection rules where available
+1 more
show less
Adds ED25519 support to Zscaler Incident Receiver configuration
6 details in Everything
Unified Vulnerability Management (UVM) — Release Upgrade Summary (2025) — 2025-02-26
Feb 26, 2025
· release notes
Adds Claroty xDome Healthcare connector for OT/IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. vulnerability data.
Asset Exposure Management — Release Upgrade Summary (2025) — 2025-02-26
Feb 26, 2025
· release notes
Adds Claroty xDome Healthcare connector to retrieve security posture and vulnerability data for OT/IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. assets
Adds support for the Claroty xDome Healthcare connector integration to retrieve asset inventory and risk scores.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-02-25
Feb 25, 2025
· release notes
ZPA introduces AI-powered application segment recommendations, PRA credential pooling, and a user platform filter for activity logs
Adds Persistent State toggle (renamed from cookie persistence) in ZPA Isolation Profiles to persist state across sessions. Introduces privileged credential pools allowing multiple credentials per policy for simultaneous PRA access with different identities. Enables generating AI-powered recommendations for application segments within the ZPA Admin Portal. Adds My Approvals section in the PRA Portal for creating, approving, or rejecting privileged approval requests. Adds user platform filter to activity logs, allowing filtering by client platform (Windows, macOS, Linux, Android, iOS).
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-02-24
Feb 24, 2025
· release notes
ZPA raises the maximum administrators limit per organization to 5,000.
Workflow Automation — Release Upgrade Summary (2025) — 2025-02-21
Feb 21, 2025
· release notes
Workflow Automation adds Client IP merge tag to email, Slack, and Teams notification templates.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-02-21
Feb 21, 2025
· release notes
ZDX adds tabular view and improved filters to Data Explorer for Hosted Monitoring
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-21
Feb 21, 2025
· release notes
ZIA adds DNS Block with Response Code action/API, Webex Teams real-time DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , NSS country log fields, and POST /exportPolicies API endpoint.
└──▷ TRY IT
Export all configured policy rules to JSON files for backup or migration.
copy
$ POST /exportPolicies
Adds BLOCK_WITH_RESPONSE action to DNS Control policy and new Response Code field for selecting the response value sent to the client Updates Cloud Service API with new POST /exportPolicies endpoint to export policy rules to JSON files Adds new attributes blockResponseCode to the FirewallDnsRule model in the Cloud Service API to specify the DNS response code Enables real-time DLP support for messages and file attachments sent via Webex Teams Adds SSH key support for ED25519 in Zscaler Incident Receiver configuration
+8 more
show less
Increases maximum department scope limit for ZIA admins and super admins to 2,048 departments Enables HTTP/2 by default when configuring an SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rule Expands predefined Credit Card dictionary and EDM data type to support China UnionPay and Maestro formats Adds Web Insights Logs filters and columns for Source IP Countries, Destination IP Countries, and their risk indicators Adds NSS Feed Output Format fields %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} for web logs Enhances IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Report to include IoT policy status, statistics, and deep-dive into action impact on domains/IPs for discovered devices Increases Sandbox Detail Reports API quota to 3,000 requests per day with rate limits of 2/sec and 1,000/hour Adds firewall control and logging capabilities for tenant-to-tenant roaming guest user scenarios
13 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-02-20
Feb 20, 2025
· release notes
ZPA Microsegmentation adds enforcement policies, resource groups, policy maps, and ZMS log streaming via API.
Adds zms_flow_log to ZPA API LSS configurations for Microsegmentation flow logs. Enables creation of Layer 3 and Layer 4 Microsegmentation enforcement policies via the Admin Portal under Microsegmentation > Policy > Settings. Adds Microsegmentation > Resource Management > Resource Groups in the Admin Portal to group resources by hosts, environments, or cloud tags. Adds a read-only Policy Map view of Microsegmentation policy configurations selectable by AppZone in the Admin Portal.
4 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-02-20
Feb 20, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI Foundry visibility, new data posture policies for PostgreSQL and SQL, unmanaged MSSQL scanning, and granular Azure onboarding.
Adds data inventory visibility for sensitive data exposed to Azure AI Foundry Hub and machine learning workspaces via storage accounts. Introduces 27 new data posture policies for Azure PostgreSQL Flexible Server, covering public exposure, authentication, logging, VNet VNet A private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. access, backup redundancy, and ransomware susceptibility. Adds four new data posture policies for Azure SQL Server addressing insecure web app access, deprecated runtimes, insecure FTP/SCM SCM Source Code Management: version-control systems (Git, SVN, etc.) that track changes to code over time, giving cyber tools reproducible builds, audit trails, and collaborative development workflows. credentials, and VNET integration gaps. Adds support for onboarding and scanning unmanaged Microsoft SQL Server (MSSQL) databases hosted on Azure virtual machines to identify misconfigurations and posture issues. Enables onboarding of Azure Management Groups during tenant setup to scan subscriptions when tenant-level restrictions exist.
+1 more
show less
Allows selective onboarding of specific Azure services (e.g., storage accounts, databases) to minimize permissions during the onboarding process.
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-02-19
Feb 19, 2025
· release notes
ZPA adds Limited Availability support for App Segment Multimatch Rule Processing and Pattern Matching via API.
Adds App Segment Multimatch rule processing to allow policy evaluation across multiple application segments instead of a single segment. Adds Pattern Matching for Application Segments, enabling hostname pattern matching in addition to exact FQDNs.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-02-18
Feb 18, 2025
· release notes
ZPA adds Transaction ID to Audit Logs and limited-availability Backup/Restore capability
Adds a Transaction ID column to the ZPA Admin Portal's Audit Logs page to bind related API requests for troubleshooting. Introduces Backup and Restore functionality in the ZPA Admin Portal, allowing configuration backup creation and restoration via support request. Adds new events in Events Diagnostics for backup/restore status (completed or failed) including backup name and ID.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-18
Feb 18, 2025
· release notes
ZIA adds case-sensitive URL logging for select domains like bit.ly and tinyurl.com in Web Insights Logs.
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-02-18
Feb 18, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure AI data exposure visibility, unmanaged MSSQL scanning, Management Group onboarding, and new posture policies.
Adds Azure AI Foundry and Storage Account association visibility to the Data Inventory page for sensitive data exposed to Azure AI services. Adds unmanaged Microsoft SQL Server (MSSQL) database support for onboarding and scanning via DSPM, with results displayed on the Data Inventory page. Adds Onboard Management Groups capability during Azure onboarding to scan subscriptions within them when tenant-level onboarding is restricted. Adds Onboard Azure Services option to select a subset of supported services (e.g., storage accounts, databases) for minimal-permission monitoring.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-17
Feb 17, 2025
· release notes
ZIA adds Complexity column, filter, and Failed Controls Remediation graph to Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Posture page.
Adds a Complexity column to the Advanced SSPM Posture page table, displaying the complexity level of each control in the Control Panel header. Adds a Complexity filter to the Advanced SSPM Posture page, allowing users to filter displayed controls by their complexity level.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-02-14
Feb 14, 2025
· release notes
New integration allows Zscaler Cloud Connector to use HashiCorp Vault for secret management on GCP
Adds HashiCorp Vault as a supported secret store option for new Zscaler Cloud Connectors on Google Cloud Platform (GCP), replacing the requirement for GCP Secret Manager. Updates GCP Terraform scripts to version v0.2.0 to support the HashiCorp Vault integration workflow. Introduces a new Cloud Connector image (zs-cc-ga-02022025) in Google Cloud Marketplace containing the updated code for HashiCorp Vault support.
3 details in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-02-14
Feb 14, 2025
· release notes
Zscaler Client Connector Portal 4.3.2 adds M365/AVD bypass for Z-Tunnel 2.0, language selection, and macOS posture intervals
Supports application bypasses for Microsoft 365 and Azure Virtual Desktop to bypass traffic for Zscaler Tunnel (Z-Tunnel) 2.0. Adds the ability for users to select their preferred language in the Zscaler Client Connector Portal including German, Japanese, Spanish, French, and Simplified Chinese. Supports configurable posture check intervals for macOS devices.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-14
Feb 14, 2025
· release notes
ZIA adds DC exclusion API endpoints, Block with Response Code DNS action, country-based log filtering, and SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. asset export
Adds GET /datacenters, GET /dcExclusions, POST /dcExclusions, PUT /dcExclusions, and DELETE /dcExclusions endpoints to the ZIA Cloud Service API for managing data center exclusions. Adds BLOCK_WITH_RESPONSE action value and blockResponseCode attribute in the FirewallDnsRule model to send response codes when blocking DNS traffic. Adds Source IP Countries, Destination IP Countries, Is Source IP Country Risky?, and Is Destination IP Country Risky? filters and columns in Web Insights Logs. Adds %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} fields to NSS Feed Output Format for web logs. Adds POST /exportPolicies endpoint to the ZIA Cloud Service API for exporting policy rules as JSON files.
+3 more
show less
Adds CSV export of the assets report, asset evidence copying, and JSON download of asset evidence in the Advanced SSPM Control Panel Assets tab. Increases administrator scope department limit to 2,048 departments for ZIA admins and super admins. Enhances IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Report to display IoT policy status and statistics for discovered devices.
8 details in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-02-13
Feb 13, 2025
· release notes
Zscaler Business Insights adds application contract upload and scheduled workplace report distribution
Adds support for uploading application contracts to view insights such as annual contract value (ACV), total contract value (TCV), spending overview, and deadlines. Adds ability to schedule attendance reports with various criteria for distribution to multiple email recipients.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-12
Feb 12, 2025
· release notes
ZIA now supports case-sensitive URL logging for select domains in Web Insights Logs and NSS feeds.
Retains original case of URLs in web logs for supported shorteners
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-11
Feb 11, 2025
· release notes
Zscaler ZIA adds real-time DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Webex Teams messages and files.
Enables real-time Data Loss Prevention (DLP) for messages and file attachments sent via Webex Teams
1 detail in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-02-07
Feb 7, 2025
· release notes
Adds workplace tagging to filter business insights views
Adds the ability to use user-defined tags to link and filter workplace insights via Tag Management
1 detail in Everything
Client Connector — Release Upgrade Summary (2025) — 2025-02-07
Feb 7, 2025
· release notes
Zscaler Client Connector Portal 4.3.2 adds app bypasses, language selection, and macOS posture intervals
Adds application bypass support for Microsoft 365 and Azure Virtual Desktop to prevent traffic loss in Zscaler Tunnel (Z-Tunnel) 2.0. Adds the ability for users to select their preferred language in the Zscaler Client Connector Portal including German, Japanese, Spanish, French, and Simplified Chinese. Adds configurable posture check intervals for macOS devices.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-02-07
Feb 7, 2025
· release notes
ZDX adds alert rules for custom network apps, hosted data views in Data Explorer, and ZPA incident types on the Incidents Dashboard.
Adds Alert Rule support for Custom Applications with Network Application Type Adds Data Explorer Views capability for Hosted Monitoring data Adds a new ZPA incident type to the Incidents Dashboard with ZPA Public Service Edge and ZPA App Connector subtypes
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-07
Feb 7, 2025
· release notes
ZIA adds tenant firewall logging for roaming guests, ED25519 incident receiver keys, OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and policy export API.
POST /exportPolicies endpoint to export rules to JSON filesSupport for ED25519 SSH key in Zscaler Incident Receiver configuration New columns in Web Insights Logs: Source IP Countries , Destination IP Countries , Is Source IP Country Risky? , and Is Destination IP Country Risky? New NSS Feed Output Format fields for web logs: %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} OCR support enabled in DLP Advanced Settings for Outbound Email DLP, inline DLP, and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API
+2 more
show less
Atlassian Label option added to Data at Rest Scanning DLP Policy configuration Default enablement of HTTP/2 in SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rules
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-02-05
Feb 5, 2025
· release notes
ZIA adds real-time DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. for Webex Teams and case-sensitive URL logging for select domains.
Adds real-time Data Loss Prevention (DLP) support for messages and file attachments sent via Webex Teams Adds case-sensitive URL logging for select domains (including bit.ly, tinyurl.com, and others) in Web Insights Logs and NSS feeds
2 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-02-03
Feb 3, 2025
· release notes
UI enhancements for Custom Email Domains management including reversion capability and expanded troubleshooting tips.
Breach Predictor — Release Upgrade Summary (2025) — 2025-02-03
Feb 3, 2025
· release notes
Breach Predictor adds Unified UI for attack paths attack paths A possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. , CrowdStrike endpoint data ingestion, and Jira/ServiceNow ticket creation integrations.
└──▷ HOW TO FIND IT
Navigate to the new Events page to investigate attack paths for a specific threat.
📍 Breach Predictor Portal › Events
Adds the Events page (Breach Predictor Portal > Events) to display context around attack path attack path A possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately. , users, and events in a unified view Adds CrowdStrike log integration for endpoint data ingestion and enrichment alongside existing ZIA and Sandbox logs Adds the ability to create Request tickets in Jira and Support tickets in ServiceNow directly from the Breach Predictor Portal
3 details in Everything
External Attack Surface Management — Release Upgrade Summary (2025) — 2025-01-31
Jan 31, 2025
· release notes
EASM EASM External Attack Surface Management: a discipline and category of tooling that continuously discovers and monitors an organization's internet-facing assets to identify exposures before attackers do. adds scan evidence display for findings on the Finding Details page to support attestation and self-validation.
Adds full scan results and specific matching evidence portions to the Finding Details page in EASM
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-31
Jan 31, 2025
· release notes
ZIA raises admin department limit to 2048, adds country filters/logs, new Sandbox API quota, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. report enhancements, and POST /exportPolicies API.
Increases the maximum number of departments selectable for a Department Scope admin from the previous limit to 2,048 Adds Destination IP Countries , Source IP Countries , Is Destination IP Country Risky? , and Is Source IP Country Risky? filters and columns to Web Insights Logs Adds %s{srcip_country}, %s{dstip_country}, %s{is_src_cntry_risky}, and %s{is_dst_cntry_risky} fields to the NSS Feed Output Format for web logs Increases Sandbox Detail Report API quota to 3,000 requests per day with rate limits of 2/sec and 1,000/hour Enhances the IoT Report to include policy status, statistics, and domain/IP action impact details in Discovered Devices views
+1 more
show less
Adds POST /exportPolicies endpoint to export policy rules to JSON files
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-28
Jan 28, 2025
· release notes
ZIA now supports case-sensitive URL logging for select domain shorteners.
Web Insights Logs and NSS feeds retain original case for URLs from domains like bit.ly and tinyurl.com.Added case-sensitive URL support for a set of shortener domains including adf.ly, cutt.ly, goo.gl, link.ly, ow.ly, rebrand.ly, snip.ly, t.ly, tiny.cc, and tinyurl.com.
2 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-01-27
Jan 27, 2025
· release notes
Zscaler Client Connector 3.8 adds posture-based risk profiles for ZIA and increases DNS search domain limits to 50.
Adds support for posture-based risk profiles for Zscaler Internet Access (ZIA). Supports up to 50 DNS search domains (suffixes) per system.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-01-24
Jan 24, 2025
· release notes
Zscaler Zero Trust Branch Connector adds SFP port support for ZT800 in gateway mode
Adds SFP port support (copper and fiber) on the ZT800 device for use in gateway mode Enables GE1 and GE2 ports to be selectable as WAN/LAN interfaces, hot-swappable, and available only for SFP modules
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-01-24
Jan 24, 2025
· release notes
ZDX adds tabular Data Explorer views and packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. disk space limits
Adds a tabular view format option to the Data Explorer, allowing customized views in addition to charts Adds a new Disk Space Limit configuration option for Packet Capture diagnostics sessions on Windows devices running ZDX Module version 4.5+
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-24
Jan 24, 2025
· release notes
ZIA adds Zoom/ShareFile/Slack SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. , Gmail Outbound DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Extranet support, new HTTP methods, DoH DoH DNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. path config, and expanded API/DLP capabilities.
└──▷ TRY IT
Manage extranet resources via the Cloud Service API
copy
$ GET /extranet
POST /extranet
PUT /extranet
GET /extranet/lite
GET /extranet/{id}
DELETE /extranet/{id}
Adds GET /extranet, POST /extranet, PUT /extranet, GET /extranet/lite, GET /extranet/{id}, and DELETE /extranet/{id} API endpoints to manage Extranet resources Adds Extranet option in the Tunnel Type filter for NSS Feeds (including Cloud NSS feeds) to limit Tunnel Insights Logs by tunnel type Adds Extranet Resources on the Extranet page, configured with traffic selectors and DNS servers, available as a Location Type in ZIA locations Adds new HTTP request methods PROPFIND, PROPPATCH, COPY, MOVE, MKCOL, LOCK, UNLOCK, and PATCH to URL Filtering rules (Policy > URL & Cloud App Control > URL Filtering Policy) Adds Gmail as an option when configuring Email Tenants in Administration > Email Tenants for Outbound Email DLP
+14 more
show less
Adds Advanced SSPM support for Zoom, ShareFile, and Slack tenants via the SSPM Scan checkbox during onboarding or under existing tenant settings Adds Extranet Insights (Analytics > Extranet Insights) to monitor IPSec tunnel health and status Adds Extranet Name column and filter to Tunnel Insights Logs Adds DLP detection for addresses, first names, last names, and full names in Japan; and US Driver's Licenses with 2-letter state codes Adds new page and drill-down links for Instance Discovery Report (Analytics > Instance Discovery Report) including Resource Discovery Report logs Adds columns App Instance Level 1/2/3 and types, plus corresponding filters, to Web Insights Logs (Analytics > Insights > Web Insights) Adds Cloud Application column to Step 2 Request Review in Site Review page Adds option to include subdomains in Email Profiles (Administration > Email Profiles > Domain Profiles) Increases custom bandwidth classes limit to 245 for Cloud Applications (Administration > Bandwidth Classes) Increases custom domains per domain profile from 32 to 1,024 Adds pageSize and page request parameters with default pageSize of 100 to GET /pacFiles API endpoint Updates Advanced Sandbox Submission API quota to 100 file submissions per day by default Adds File Type Control and DLP support for .xla, .odt, .pub, and .bin file types across Microsoft Office, Open Office Files, and Other Documents categories Adds customized URL path configuration for DNS servers using DNS over HTTP (DoH) in DNS Gateways
19 details in Everything
Client Connector — ZDX Module Release Summary (2025) — 2025-01-22
Jan 22, 2025
· release notes
ZDX Module 3.9.1 adds a network detection module that displays an error in the UI when no network is available.
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-22
Jan 22, 2025
· release notes
ZIA adds PROPFIND, PROPPATCH, COPY, MOVE, MKCOL, LOCK, UNLOCK, PATCH to URL Filtering Rule request methods
Workflow Automation — Release Upgrade Summary (2025) — 2025-01-21
Jan 21, 2025
· release notes
Workflow Automation now supports custom email domains for incident notifications.
Adds the ability to configure custom email domains in the Data Protection integration, allowing Workflow Automation to use them as the sender for email notifications. Enables admins to set up custom email domains via the Custom Email Domain page in the Zscaler Automation UI.
2 details in Everything
Client Connector — Client Connector App Release Summary (2025) — 2025-01-21
Jan 21, 2025
· release notes
Client Connector 4.5 adds ZPA VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. for Legacy Apps, new trusted network conditions, and UI auth options.
Adds support for VPN (for Legacy Apps) to provide secure access for call centers or server-to-client applications using Network Connectors and VPN Service Edges Adds the following trusted network conditions in the Zscaler Client Connector Portal: Network Range, Default Gateway IP Addresses, and DHCP Server Adds the Authenticate option to the taskbar menu, allowing users to authenticate Zscaler Client Connector without opening the app Supports configurable posture check intervals
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-21
Jan 21, 2025
· release notes
ZIA adds Atlassian Label for Data at Rest DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and new file types to File Type Control
Adds Atlassian Label option in the Add DLP Rule window (Policy > Data at Rest Scanning) to apply labels during Data at Rest scanning for Atlassian Confluence users. Expands File Type Control and DLP policies with support for Microsoft Outlook Mac Data (.olm), Publisher (.pub), TNEF (.tnef), LZH/CPIO archives, Binhex (.hqx), QuarkXPress (.qxd/.qxp), AutoCAD (.dxf/.dwg), and Domino Server Database (.dxl) file types.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-20
Jan 20, 2025
· release notes
ZIA Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. posture controls report now exports Description, Tenant Name, Platform, and Severity columns in CSV.
Cloud & Branch Connector — Release Upgrade Summary (2025) — 2025-01-17
Jan 17, 2025
· release notes
ZT800 Zero Trust Branch Device now supports SFP ports in gateway mode with selectable WAN/LAN interfaces.
Adds support for copper and fiber small form-factor pluggable (SFP) ports on the ZT800 device in gateway mode Allows GE1 and GE2 ports to be configured as hot-swappable WAN or LAN interfaces exclusively for SFP modules
2 details in Everything
Business Insights — Release Upgrade Summary (2025) — 2025-01-17
Jan 17, 2025
· release notes
Business Insights adds State and Country fields for workplaces on the Offices and Locations page.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2025) — 2025-01-17
Jan 17, 2025
· release notes
ZDX adds Admin scope by app, dark mode, admin CSV export, and standard sub Cloud Path access
Adds Applications as an admin scope option when configuring a ZDX Admin Adds Dark Mode theme selection via the My Profile menu Adds Export action to download a CSV file of ZDX Admins from the Administrators page Enables Full Cloud Path visibility in Hop View and Command Line View for ZDX Standard subscriptions
4 details in Everything
Authentication Service — Release Upgrade Summary (2025) — 2025-01-17
Jan 17, 2025
· release notes
Authentication Service adds self-service registration link regeneration via admin console.
Enables administrators to regenerate one-time user registration links that have expired or become invalid.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-17
Jan 17, 2025
· release notes
ZIA adds Gmail outbound email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , ShareFile/Slack/Zoom SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. support, extensive Cloud Service API endpoints, and advanced DLP/Sandbox capabilities.
Adds SSPM Scan checkbox in the onboarding section to enable Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management for ShareFile tenants Adds SSPM Scan checkbox in the onboarding section to enable Advanced SaaS Security Posture Management for Slack tenants Adds SSPM Scan checkbox in the onboarding section to enable Advanced SaaS Security Posture Management for Zoom tenants Adds Gmail as a selectable tenant option under Administration > Email Tenants for Outbound Email Data Loss Prevention policies Supports new predefined DLP dictionaries: Addresses (Japan), First Names (Japan), Last Names (Japan), Full Names (Japan), and US Driver's Licenses with 2-letter state codes
+9 more
show less
Adds support for .xla, .odt, .pub, and .bin file types in File Type Control & DLP policies Increases the limit for custom bandwidth classes to 245 via Administration > Bandwidth Classes Increases custom domains allowed per domain profile from 32 to 1,024 Adds a new Trace ID value to Audit Logs and the traceId field in the AuditLogEntryRequest model for the /auditlogEntryReport endpoint via Zscaler OneAPI Supports customized URL paths for DNS servers using DNS over HTTP (DoH DoH DNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. ) in DNS Gateways Adds pagination parameters pageSize and page to the GET /pacFiles Cloud Service API endpoint Adds new Cloud Service API endpoints for programmatic management of Malware Protection, Advanced Threat Protection, File Type Control, Sandbox Policy, URL Filtering, DNS Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Cloud Applications, Proxy Gateways, Authentication Settings, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Adds Instance Discovery Report page under Analytics with drill-down to Resource Discovery Report logs Adds columns for App Instance Levels (1-3) and their Types to Web Insights Logs under Analytics > Insights > Web Insights
14 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-01-16
Jan 16, 2025
· release notes
ZPA updates system metrics for invalid listen IP configurations and releases new RPM packages for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. .
Private Access (ZPA) — App Connector Release Summary (2025) — 2025-01-16
Jan 16, 2025
· release notes
App Connector 24.692.8 adds support for AppProtection OWASP OWASP A nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. predefined control exceptions
Releases updated App Connector RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9.x
1 detail in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2025) — 2025-01-16
Jan 16, 2025
· release notes
ZPA Private Service Edge 24.692.8 adds Adaptive Access Engine support and invalid listen IP event handling.
Adds events for invalid System Listen IP Address configuration
1 detail in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-01-16
Jan 16, 2025
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Compliance dashboard, DynamoDB custom policies, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. logging posture, Azure PostgreSQL scanning, and local MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. .
Adds Compliance dashboard to view breaches against CIS CIS A nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. , NIST, PCI DSS PCI DSS The Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. , HIPAA HIPAA A US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. , GDPR GDPR EU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. , DPDP, CCPA, RBI, ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, and SOC2 benchmarks with remediation steps Adds support for deploying Orchestrator and Scanner instances in a custom network during Cloud Accounts onboarding Adds Azure Diagnostic Logs Storage config option to specify an existing or new Azure storage account for diagnostic logs Adds entitlements for AWS DynamoDB, allowing custom policies and investigation queries that reference DynamoDB permissions Adds Logging security posture state predicate for AWS EC2 instances in policy and investigation queries
+3 more
show less
Adds MFA for local users, sending a 10-minute valid verification code to the registered email address upon login ID entry Adds scan settings option for Azure-Managed PostgreSQL Flexible Server Adds Data Sampling Scan and Full Scan options to database scanning configuration
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-15
Jan 15, 2025
· release notes
ZIA expands DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and sandbox support for new file types and ML-based dictionaries.
Adds ID Card , Medical Imaging , Satellite Data , and Schematic Data as new predefined ML-based DLP dictionaries. Extends File Type Control and DLP policies to detect .olm, .pub, .tnef, .lzh, .lha, .cpio, .hqx, .qxd, .qxp, .dxf, .dwg, and .dxl file types.
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2025) — 2025-01-15
Jan 15, 2025
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Compliance Dashboard, MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for local users, and new DynamoDB/PostgreSQL capabilities
Adds a Compliance dashboard to visualize breaches against regulations like CIS CIS A nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. , NIST, PCI DSS PCI DSS The Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. , HIPAA HIPAA A US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. , GDPR GDPR EU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. , DPDP, CCPA, RBI, ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, and SOC2. Enables MFA for local users by sending a 10-minute verification code to their registered email address upon login. Adds support for custom policies and investigation queries using entitlements predicates for AWS DynamoDB tables. Adds the Logging security posture state and corresponding predicate for querying AWS EC2 instance logging status. Adds scanning support for Azure-Managed PostgreSQL Flexible Server with dedicated predefined policies.
+1 more
show less
Introduces new database scan options: Data Sampling Scan and Full Scan to control scan scope and cost.
6 details in Everything
Zero Trust Branch — Release Upgrade Summary (2025) — 2025-01-15
Jan 15, 2025
· release notes
Zero Trust Branch 7.8 adds Zero Touch Provisioning, ZIA over GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. , Site-to-Site WireGuard WireGuard A modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. , and default custom templates.
Adds Zero Touch Provisioning via single URL click for remote/branch onboarding Adds default and custom Device Segmentation templates for ZT800 and VM form factors Adds ZIA connectivity over GRE with policy-based routing configuration Adds source-based traffic selection using user, port, IP, network, MAC, or device attributes Adds Site-to-Site VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. support via WireGuard connections between isolated networks
+1 more
show less
Adds dedicated high-availability link for faster failover times
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-13
Jan 13, 2025
· release notes
ZIA adds OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. on image files, new Device Control policy rules, Inventory views, and Timeline analytics
Adds Optical Character Recognition (OCR) scanning of PNG, JPEG, TIFF, and BMP files to Endpoint DLP for subscriptions with the ZS-DP-CLASS-ADV SKU Adds Device Control policy rules in the UI for regulating removable storage devices and printers via intercept Adds Inventory view in Analytics showing visibility into removable storage, printers, and portable device usage with DLP activity analysis Adds file attribute columns (Last Modification Time, Last Accessed Time, Creation Time) to exported data on the Endpoint Data Scan page
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-01-10
Jan 10, 2025
· release notes
ZPA adds Attack Surface Reduction column and CSV export to AI-Powered Recommendations
Enables downloading all AI-powered recommended application segments as a CSV file.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-10
Jan 10, 2025
· release notes
ZIA adds Zoom SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. onboarding, new API endpoints for policies/EUNs, DoH DoH DNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. path support, and Trace ID in audit logs
SSPM Scan checkbox enables Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management for Zoom tenants during or after onboardingtraceId field added to AuditLogEntryRequest model in the /auditlogEntryReport endpoint and Audit LogsNew API endpoints GET /eun and PUT /eun for retrieving and updating browser-based end user notification configuration Comprehensive new Cloud Service API endpoints for programmatic management of Malware Protection, ATP, File Type, Sandbox, URL Filtering, DNS Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies, cloud apps, proxy gateways, auth settings, remote assistance, NSS feeds, org info, and advanced settings DNS Gateways support a customized URL path for DNS servers using the DNS over HTTP (DoH) protocol
+2 more
show less
New URL categories Newly Registered and Observed Domains in the Miscellaneous section of File Type Control and Sandbox Policies ZPA application segment limit increased to 2,000 segments when configuring Source IP Anchoring in the ZIA Admin Portal
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-01-09
Jan 9, 2025
· release notes
ZPA adds STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -compliant RHEL9 images for Azure and bulk Application Segment Import.
Adds Red Hat Enterprise Linux 9 Private Service Edge image with Security Technical Implementation Guide (STIG) support on Microsoft Azure Adds Application Segment Import feature to upload and merge application data in bulk
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2025) — 2025-01-08
Jan 8, 2025
· release notes
ZPA adds Extranet connector type to allow accessing partner apps without local App Connectors or extended IPSec tunnels.
Adds Extranet as a new connector type for application segments, enabling access to business partner private applications via the Zero Trust Exchange. Synchronizes partner locations and location groups from ZIA cloud to ZPA cloud for mapping to server groups.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2025) — 2025-01-08
Jan 8, 2025
· release notes
ZIA adds Extranet Application Support for partner IPSec access with new API endpoints and UI locations
Adds GET /extranet, POST /extranet, PUT /extranet, GET /extranet/lite, and GET /extranet/{id} API endpoints for managing extranet resources via the Zscaler Cloud Service API Adds DELETE /extranet/{id} API endpoint to remove configured extranet resources Adds new attributes extranet, extranetIpPool, extranetDns, defaultExtranetTsPool, and defaultExtranetDns to the Location model for mapping extranet configuration Adds Extranet as a selectable Location Type in the Admin Portal UI to assign partner resources to locations Adds Extranet Insights view under Analytics > Extranet Insights to monitor IPSec tunnel health and status
+2 more
show less
Adds Extranet Name column and filter to Tunnel Insights Logs for filtering log data by extranet Adds Extranet option in the Tunnel Type filter when configuring NSS or Cloud NSS feeds for Tunnel logs
7 details in Everything
Workflow Automation — Release Upgrade Summary (2025) — 2025-01-06
Jan 6, 2025
· release notes
New Obfuscation settings for phone numbers and SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. email retrieval in Account Settings page
Adds Retrieve User Email from Primary Data Source option to the Incident Management section of the Account Settings page to fetch user emails from SCIM or CSV attributes for incidents. Adds phone number obfuscation setting on the Account Settings page that affects admin visibility on Incidents, Incident Details, and workflow pages, with override capability on the Admin Assignment page.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-20
Dec 20, 2024
· release notes
ZIA adds OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for outbound email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Gmail support, new file types, ShareFile/Slack SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. , API pagination, and custom domain limits.
Adds sspmscan checkbox on ShareFile tenant onboarding to enable Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) Adds sspmscan checkbox on Slack tenant onboarding to enable Advanced SaaS Security Posture Management (SSPM) Enables Optical Character Recognition (OCR) for Outbound Email DLP via the Administration > DLP Advanced Settings page Adds Gmail as a selectable tenant type in Administration > Email Tenants for Outbound Email Data Loss Prevention Adds support for Microsoft Excel Add-On (.xla), Open Document Files (.odt), Public Key File (.pub), and Binary Files (.bin) in File Type Control & DLP policies
+10 more
show less
Adds Atlassian Label option when configuring Data at Rest Scanning DLP Policy rules for Confluence users Adds new predefined DLP dictionaries: Addresses (Japan), First Names (Japan), Last Names ( Japan), Full Names (Japan) Updates Driver's License (United States) DLP dictionary to support 2-letter state codes for all US states Adds pageSize and page request parameters to the GET /pacFiles API endpoint for pagination support Increases the number of custom domains allowed per domain profile from 32 to 1,024 Adds App Instance Level 1, 2, 3 and their Type columns and filters to Web Insights Logs (Analytics > Insights > Web Insights) Adds a new Instance Discovery Report page under Analytics for monitoring GCP instance hierarchy logs Adds Cloud Application column to Step 2 Request Review on the Site Review page Adds toggle in Administration > Email Profiles > Domain Profiles to include subdomains in email domain profiles Adds fileSize and documentType fields to the Incident Receiver JSON metadata file for Inline Web DLP violations
15 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-12-20
Dec 20, 2024
· release notes
ZT800 ZTBC now supports SFP ports (copper/fiber) and GE1/GE2 WAN/LAN selection in gateway mode
Adds SFP port support (Finisar FCLF8522P2BTL copper, FTLF8519P3BNL SR fiber, FTLF1318P3BTL LR fiber) to the ZT800 Zero Trust Branch Device in gateway mode Makes GE1 and GE2 hot-swappable ports selectable as WAN or LAN when using SFP modules
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-18
Dec 18, 2024
· release notes
ZIA adds Platform filter on SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. Posture page, Findings filters on 3rd-Party Governance Users page, expanded Sandbox file types, and manual control severity overrides.
Adds Platforms filter to the Posture page in Advanced SSPM Expands Sandbox supported file types to include .msi, .bat, and .wsf Adds ability to change control severity on the Posture page or Control Panel header in Advanced SSPM
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-18
Dec 18, 2024
· release notes
ZPA adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. protection controls and per-profile language translation in isolation.
Adds Active Directory as an AppProtection Control option to enable inspection of Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. , and LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. protocol traffic within application segments. Adds a new Active Directory Dashboard page to view suspicious activity, errors, and violations for AD protection controls. Enables admins to enable language translation via Google Translate per isolation profile, accessible via the isolation bar menu or right-click context menu.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-17
Dec 17, 2024
· release notes
ZPA adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. Controls and Azure STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. RHEL9 App Connector support
Adds Active Directory as an option in the AppProtection control list for application segments, enabling inspection of Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. , and LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. protocol traffic. Adds a dedicated Active Directory Dashboard page to view suspicious activity, errors, and violations for Active Directory protection controls. Adds a Red Hat Enterprise Linux 9 App Connector image on Microsoft Azure that enforces Security Technical Implementation Guide (STIG) compliance.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Passwords for STIG-hardened RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 App Connector images automatically expire after 60 days; if not disabled or changed, admin access becomes unavailable and the connector must be redeployed.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-16
Dec 16, 2024
· release notes
ZIA updates isolation profiles on zscaler.net and other clouds to support Cookie Persistence for session state restoration.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-16
Dec 16, 2024
· release notes
ZPA adds STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -hardened App Connector and PSE images on Nutanix/VMware and Cookie Persistence for isolation sessions.
Adds STIG-hardened Red Hat Enterprise Linux 9 App Connector and ZPA Private Service Edge images for Nutanix and VMware, with automatic password expiration after 95 days. Enables Cookie Persistence in Isolation Profiles to automatically restore isolation session state upon timeout.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-13
Dec 13, 2024
· release notes
ZIA adds Gmail outbound DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for Slack/ShareFile, new API endpoints, and enhanced file type/DLP capabilities
Outbound Email DLP for Gmail allows enforcing DLP policies on emails sent to external domains via the ZIA Admin Portal. Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) support for ShareFile tenants enables scanning via the SSPM Scan checkbox during onboarding. Advanced SaaS Security Posture Management (SSPM) support for Slack tenants enables scanning via the SSPM Scan checkbox during onboarding. New file types (.xla, .odt, .pub, .bin) are supported in File Type Control and DLP policies across Microsoft Office, Open Office Files, and Other Documents categories. DLP now detects PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. using new predefined dictionaries: Addresses (Japan), First Names (Japan), Last Names (Japan), Full Names (Japan).
+26 more
show less
DLP Driver's License (United States) dictionary adds support for 2-letter state codes as high confidence phrases. Instance Discovery Report logs gain App Instance Level 1, 2, 3 columns and filters in Web Insights Logs. Cloud Service API adds new endpoints for End User Notifications: GET /eun and PUT /eun. Cloud Service API extends programmatic access with new categories of endpoints including Malware Protection Policy, Advanced Threat Protection Policy, DNS Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, and more. DNS Control policy rules are now manageable via API endpoints GET/POST/PUT/DELETE /firewallDnsRules. IPS Control policy rules are now manageable via API endpoints GET/POST/PUT/DELETE /firewallIpsRules. File Type Control rules are now manageable via API endpoints including GET/POST/PUT/DELETE /fileTypeRules and /fileTypeRules/{ruleId}. Sandbox rules are now manageable via API endpoints GET/POST/PUT/DELETE /sandboxRules and /sandboxRules/{ruleId}. Malware Protection policy configurations are accessible via endpoints such as GET/PUT /cyberThreatProtection/atpMalwareInspection and related. Advanced Threat Protection policy configurations are accessible via endpoints such as GET/PUT /cyberThreatProtection/maliciousUrls and related. Cloud NSS feeds are now manageable via API endpoints including GET/POST/PUT/DELETE /nssFeeds. SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rules are now manageable via API endpoints GET/POST/PUT/DELETE /sslInspectionRules and /sslInspectionRules/{ruleId}.Organization and subscription information is accessible via API endpoints GET /orgInformation, GET /orgInformation/lite, and GET /subscriptions. Proxy gateway information is accessible via API endpoints GET /proxyGateways and GET /proxyGateways/lite. Authentication settings are accessible/updated via API endpoints GET/GET /authSettings and PUT /authSettings. Remote Assistance preferences are accessible/updated via API endpoints GET/PUT /remoteAssistance. Advanced settings for URL Filtering and Cloud App Control are accessible/updated via API endpoints GET/PUT /advancedUrlFilterAndCloudAppSettings. General advanced cloud configuration settings are accessible/updated via API endpoints GET/PUT /advancedSettings. GET /pacFiles endpoint supports pagination with new pageSize and page request parameters. Audit logs now include a new Trace ID for transactions associated with ZIA API requests made through Zscaler OneAPI. Zscaler Incident Receiver JSON metadata now includes new fields: fileSize and documentType. Zscaler Incident Receiver Inline Web DLP metadata now includes new fields: referrerUrl and department. You can choose whether to include subdomains in email domain profiles via Administration > Email Profiles > Domain Profiles. Custom bandwidth classes limit increased to 245 for Cloud Applications. Custom domains allowed per domain profile increased from 32 to 1,024. Site Review now displays the associated Cloud Application in the Cloud Application column on the Request Review page.
31 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-12-13
Dec 13, 2024
· release notes
ZDX adds Wi-Fi dashboard filters for access point prefixes and a tabular list view of APs.
Adds an Access Point Prefix filter on the Wi-Fi dashboard to narrow down devices by their connected wireless access point identifiers Adds a tabular List View to the Wi-Fi dashboard showing Wi-Fi access points for devices within your organization
2 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-12-11
Dec 11, 2024
· release notes
Client Connector 4.6 adds Legacy VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. support, fail-open/close settings, health metrics, partner login overrides, and custom banners.
Adds support for VPN (for Legacy Apps) using Network Connectors and VPN Service Edges to create secure connections Adds fail-open settings to the app profile that can override the global fail-open settings Supports using a fail-close policy when Zscaler Client Connector is in Strict Enforcement mode and is in a fail-close state Adds support for partner login settings on the app profile that can override global ZPA Partner Logins settings Adds support for the collection of Health Metrics on devices to allow for diagnostics and proactively identify issues
+9 more
show less
Adds the ability to automatically resize the Zscaler Client Connector window during authentication to fit the IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. page Adds the ability to display a custom notification to users who attempt to access the internet when in Strict Enforcement mode Enhances CrowdStrike ZTA posture with two new device posture checks: CrowdStrike ZTA Device OS Score and CrowdStrike ZTA Sensor Setting Score Adds the ability to create a custom banner with information about your organization and display it on the app Supports Egress IP as a condition for trusted network criteria Updates the forwarding profile settings to drop IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. packets from IPv6-only networks, and renames the Drop IPv6 Packets option that drops IPv6 packets in dual stack networks Supports Dynamic ZIA Service Edge Assignment with ZIA Private Service Edges and ZIA Virtual Service Edges Adds the ability to specify a registry key to locate the PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URL on forwarding profiles using the Enforce and None modes Improves DNS request handling by adding the ability to prioritize domain exclusions over IP inclusions when determining whether a DNS request should bypass Z-Tunnel 2.0
14 details in Everything
└──▷ BREAKING ON UPGRADE
! The Drop IPv6 Packets option in forwarding profiles is renamed for dual stack networks, and the default behavior for dropping IPv6 packets from IPv6-only networks is now explicit.
Client Connector — ZDX Module Release Summary (2024) — 2024-12-10
Dec 10, 2024
· release notes
ZDX Module 4.4 adds Health Metrics collection for proactive device diagnostics
Adds support for Health Metrics collection on devices to allow for diagnostics and to proactively identify issues. Adds handling of Personally Identifiable Information (PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. ) for new features.
2 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-12-09
Dec 9, 2024
· release notes
Risk360 adds Identity Protection factor groups for Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. , Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. , and Credential Exposure to the Compromise category.
Adds Active Directory factor group under Identity Protection in the Compromise category Adds Entra ID factor group under Identity Protection in the Compromise category Adds Credential Exposure factor group under Identity Protection in the Compromise category
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-12-09
Dec 9, 2024
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS DynamoDB support, new data posture policies for AWS/Azure/GCP, and improved alert graph features.
Adds NoSQL data store category to scan settings and supports scanning/classifying AWS DynamoDB tables Adds new data posture policies for AWS S3, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , RDS; Azure VMs, SQL Server, Storage Accounts; and GCP Storage Buckets Enhances alert graph with interactive CVE viewing, vulnerability search/filtering, file count per node, and direct links to Data Inventory Adds Risk Level filter (Critical, High, Medium, Low) in Data Inventory and displays scanned data quantity per resource Adds Not Included In operator for Access Level predicate and iLike/Not iLike operators for case-agnostic string comparison
+4 more
show less
Adds support for AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. context keys: aws:PrincipalTag/tag-key, aws:ResourceTag/tag-key, aws:PrincipalOrgID, aws:PrincipalArn in data posture policies Adds discovery of API Gateways accessing primary resources via IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. roles Adds predicate relationships for DynamoDB: Can be accessed by and Access Level over Parent Resource Integrates DSPM scan framework with Zscaler Cloud Connector for internet-bound traffic routing
9 details in Everything
└──▷ BREAKING ON UPGRADE
! Last Scanned column renamed to Last Completed Scan in Data Inventory table! Scan Status column renamed to Latest Scan Status in Data Inventory table
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-06
Dec 6, 2024
· release notes
ZIA adds programmatic management for DNS/IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. /File Type/Sandbox/SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. policies and new API endpoints for EUNs, NSS feeds, and org info.
Adds GET /eun and PUT /eun endpoints to the Cloud Service API for retrieving and updating browser-based End User Notification (EUN) configurations Adds GET /firewallDnsRules, POST /firewallDnsRules, GET /firewallDnsRules/{ruleId}, PUT /firewallDnsRules/{ruleId}, and DELETE /firewallDnsRules/{ruleId} endpoints to manage DNS Control policy rules programmatically Adds GET /firewallIpsRules, POST /firewallIpsRules, GET /firewallIpsRules/{ruleId}, PUT /firewallIpsRules/{ruleId}, and DELETE /firewallIpsRules/{ruleId} endpoints to manage IPS Control policy rules programmatically Adds GET /fileTypeRules, GET /fileTypeRules/lite, POST /fileTypeRules, GET /fileTypeRules/{ruleId}, PUT /fileTypeRules/{ruleId}, and DELETE /fileTypeRules/{ruleId} endpoints to manage File Type Control rules programmatically Adds GET /sandboxRules, POST /sandboxRules, GET /sandboxRules/{ruleId}, PUT /sandboxRules/{ruleId}, and DELETE /sandboxRules/{ruleId} endpoints to manage Sandbox policy rules programmatically
+14 more
show less
Adds GET /sslInspectionRules, POST /sslInspectionRules, GET /sslInspectionRules/{ruleId}, PUT /sslInspectionRules/{ruleId}, and DELETE /sslInspectionRules/{ruleId} endpoints to manage SSL Inspection rules programmatically Adds GET /cyberThreatProtection/atpMalwareInspection, PUT /cyberThreatProtection/atpMalwareInspection, GET /cyberThreatProtection/atpMalwareProtocols, PUT /cyberThreatProtection/atpMalwareProtocols, GET /cyberThreatProtection/malwareSettings, PUT /cyberThreatProtection/malwareSettings, GET /cyberThreatProtection/malwarePolicy, and PUT /cyberThreatProtection/malwarePolicy endpoints to manage Malware Protection policy configurations Adds GET /cyberThreatProtection/advancedThreatSettings, PUT /cyberThreatProtection/advancedThreatSettings, GET /cyberThreatProtection/maliciousUrls, PUT /cyberThreatProtection/maliciousUrls, GET /cyberThreatProtection/securityExceptions, and PUT /cyberThreatProtection/securityExceptions endpoints to manage Advanced Threat Protection policy configurations Adds GET /advancedUrlFilterAndCloudAppSettings and PUT /advancedUrlFilterAndCloudAppSettings endpoints to update advanced settings for URL Filtering and Cloud App Control policies Adds GET /advancedSettings and PUT /advancedSettings endpoints to manage cloud configuration advanced settings Adds GET /nssFeeds, POST /nssFeeds, GET /nssFeeds/{feedId}, PUT /nssFeeds/{feedId}, DELETE /nssFeeds/{feedId}, GET /nssFeeds/feedOutputDefaults, GET /nssFeeds/testConnectivity/{feedId}, and POST /nssFeeds/validateFeedFormat endpoints to manage Cloud NSS feeds Adds GET /orgInformation, GET /orgInformation/lite, and GET /subscriptions endpoints to retrieve organization details and subscription information Adds GET /proxyGateways and GET /proxyGateways/lite endpoints to retrieve proxy gateway information Adds GET /authSettings, GET /authSettings/lite, and PUT /authSettings endpoints to retrieve or update default authentication settings Adds GET /remoteAssistance and PUT /remoteAssistance endpoints to update Remote Assistance preferences Adds GET /cloudApplications/policy and GET /cloudApplications/sslPolicy endpoints to list cloud applications associated with various policies Adds a new traceId field in the AuditLogEntryRequest model for the /auditlogEntryReport endpoint API Adds Show Notification for ATP Blocks checkbox in the Action section of SSL Inspection rules to send End User Notifications for ATP blocks Extends Tenant Profiles feature to the GitHub application, allowing access control for specific enterprise slugs
19 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-12-06
Dec 6, 2024
· release notes
ZT800 Zero Trust Branch Device adds SFP port support in gateway mode
Makes GE1 and GE2 ports selectable as WAN/LAN and hot-swappable when using SFP modules
1 detail in Everything
Client Connector — Release Upgrade Summary (2024) — 2024-12-06
Dec 6, 2024
· release notes
Zscaler Client Connector Portal 4.3.1 enhances user/group selection UX in app profiles
Enhances a more user-friendly selection for users and user groups in app profiles
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-05
Dec 5, 2024
· release notes
Isolation for PDFTron file viewing limit increased to 100 MB across all ZIA clouds
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-05
Dec 5, 2024
· release notes
Zscaler Private Access increases file size limit for PDFTron viewing in Isolation to 100 MB
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-04
Dec 4, 2024
· release notes
ZIA DNS Gateways now support customized URL paths for DNS over HTTP (DoH DoH DNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. ) servers.
Adds the ability to configure a custom URL path for DNS servers using DNS over HTTP (DoH) in DNS Gateways.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-04
Dec 4, 2024
· release notes
Update to default primary domain formatting for ZPA Private Access on private.zscaler.com and zpatwo.net.
Deception — Release Upgrade Summary (2024) — 2024-12-04
Dec 4, 2024
· release notes
Zscaler Deception adds Generative AI decoys, Safe Processes to process tree checks, bulk blocklist creation, and deploy strategy UI enhancements.
Adds Safe Processes to Process Tree Check configuration, allowing safe programs to be excluded from event generation in decoy interactions. Enables bulk blocklist creation on the Blocklists page (Deceive > Deceive Settings > Blocklist) for application across multiple Decoy Connectors. Adds Generative AI decoys (Interactive and File-based) with specific application datasets (e.g., GenAI OpenWebUI, Apache Airflow Apache Airflow An open-source workflow orchestration platform maintained by the Apache Software Foundation that lets developers schedule, monitor, and chain tasks as directed acyclic graphs, making it useful for automating data pipelines. ) and file datasets (e.g., Falcon-7b , GPT-2 Large ). Enhances Landmine Policies by updating Browser Lures, Session Lures, and File Decoys to support targeting Generative AI decoys. Adds a Generative AI Network Personality feature for deploying Generative AI decoys via network decoys or deception strategies.
+4 more
show less
Updates Deploy Strategy UI: default ZPA and Landmine toggles enabled by default for ZPA decoy types, auto-selection of all ZPA domains, copy icon for hostnames, new default naming convention <Strategy name> <Date and time>, and conditional Create Decoys button. Adds Gen AI Malicious Input Prompt ThreatParse rule to detect and categorize malicious prompts against Generative AI decoys using Deception AI enrichment. Adds static dataset for Ivanti Virtual Traffic Manager (vTM) application. Supports selecting specific Threat Intelligence (TI) or network decoys as target decoys in the Target Decoys drop-down when configuring credential file decoys via landmine policies.
9 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-12-04
Dec 4, 2024
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds AWS DynamoDB support, NoSQL scan settings, new data posture policies for AWS/Azure/GCP, and case-insensitive query operators.
Adds support for AWS DynamoDB as a data store with dedicated scan setting category Adds NoSQL category in scan settings to enable scanning and classification of DynamoDB tables Adds new data posture policies for S3, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , RDS, Azure VMs/SQL/Storage, GCP buckets, and Lambda access patterns covering malware, sensitive data, MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. gaps, and public exposure risks Adds iLike (i%) and Not iLike (!i%) case-agnostic operators for string comparison in investigation and policy queries Adds ⊈ (Not Included In) operator for the Access Level predicate to exclude specific access levels in policy queries
+13 more
show less
Adds new DynamoDB relationship predicates: Can be accessed by and Access Level over Parent Resource for querying DynamoDB resources Adds aws:PrincipalTag/tag-key, aws:ResourceTag/tag-key, aws:PrincipalOrgID, and aws:PrincipalArn context keys support in IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies for access control analysis Adds discovery of API Gateways that have access to the primary resource via an IAM role Adds interactive CVE viewing, vulnerability search/filter, file count nodes, and Data Inventory links in the Alert Graph Adds Risk Level Filter (Critical/High/Medium/Low) and Last Completed Scan column renames in the Data Inventory page Adds view for publicly exposed files/folders with anonymous access verification in the Data Inventory Adds data inventory tile showing total data scanned per resource and specific entity access levels Adds Cloud Service Provider name appended to resource types (e.g., AWS EC Instance, Azure SQL Server) in the Data Inventory Adds timestamped error messages in scan results for troubleshooting Adds Insights Report dashboard tiles summarizing alerts by threat category and severity across AWS, Azure, GCP Integrates DSPM with Zscaler Cloud Connector to route outbound internet traffic through Zscaler Cloud Connector without public IPs Allows configuring scan scope to run DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engines only on relevant file types to reduce false positives Adds visibility into reasons for failed third-party integrations to aid troubleshooting
18 details in Everything
└──▷ BREAKING ON UPGRADE
! The Last Scanned column in the Data Inventory table has been renamed to Last Completed Scan .! The Scan Status column in the Data Inventory table has been renamed to Latest Scan Status .
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-12-02
Dec 2, 2024
· release notes
ZIA adds App Inventory filters, Integration status icons, and SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. compliance mapping
Adds a filter to the App Inventory page in 3rd-Party App Governance to view results from the inventory, 3rd-Party App Governance catalog, or both. Adds pending and error icons to the Integrations banner in 3rd-Party App Governance to indicate tenant processing status and errors. Adds a Compliance page in Advanced SSPM to view control mapping for frameworks like GDPR GDPR EU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. and NIST.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-12-02
Dec 2, 2024
· release notes
ZPA adds version check and automated upgrade enforcement for App Connectors and PSE.
Adds Minimum Version Control for App Connectors and ZPA Private Service Edges to enforce version checks and automated upgrades during initial connection.
1 detail in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2024) — 2024-12-02
Dec 2, 2024
· release notes
ZPA adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. controls for App Protection and allows sharing FQDNs across multiple application segments.
AppProtection now supports Active Directory controls, enabling AD-based policies for protected applicationsApplication segments can now use the same Application (FQDN) for multiple segments
2 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-12-02
Dec 2, 2024
· release notes
Zscaler Workflow Automation adds user attribute obfuscation, incident severity column, and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Azure validation button.
Adds user attribute obfuscation settings in the Privacy and Security section of Account Settings to mask PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. in incidents Adds a Severity column to the Incidents table Adds a Validate button on the add Zscaler DLP Azure Integration page to verify configuration before saving Adds Files section with Policy column on Incident Details page for Source DLP type Email incidents Adds Module and Resource filters to the Audit Logs page
5 details in Everything
Private Access (ZPA) — App Connector Release Summary (2024) — 2024-12-02
Dec 2, 2024
· release notes
App Connector 24.650.5 adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. controls for AppProtection, generic subdomain inspection improvements, and RPM packages for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 7/8/9.
Improves AppProtection inspection for subdomains when they include a generic domain Updates App Connector RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9.x
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-11-26
Nov 26, 2024
· release notes
STIG STIG A configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. -hardened images now enforce 60-day password expiration; recovery requires redeployment if the password expires without being disabled.
Risk360 — Release Upgrade Summary (2024) — 2024-11-26
Nov 26, 2024
· release notes
Risk360 Enhances Alerts UI with ID/Mute Visibility, Trigger History, and New Rule Templates
Ongoing Alerts table now exposes the alert_id and alert mute status directly in the Risk360 Admin Portal view. Alerts History table now displays the alert_id for historical rule references. Ongoing Alert drawer now reveals the alert trigger cause history and change details across organization, category, factor group, and factor levels. Add Alert Rule wizard now includes 5 predefined customizable rule templates to accelerate alert configuration.
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-11-25
Nov 25, 2024
· release notes
ZPA PRA Portal adds per-session keyboard layout, resolution, quality, and timezone configuration.
Adds Settings dialog in the Privileged Remote Access (PRA) Portal to configure keyboard language, display resolution (default Fit to Bounds ), display quality (High for Windows), and time zone for assigned privileged consoles Adds a collapsible post-login menu on privileged consoles showing favicon, console name, Recording/Participants/Keyboard/Full Screen/Copy/Clipboard icons, session duration, and an End option to terminate the live session
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-22
Nov 22, 2024
· release notes
ZIA adds extensive Cloud Service API endpoints for policy management and EUNs; Gen AI support in Data at Rest Scanning.
Adds traceId field to the /auditlogEntryReport endpoint's AuditLogEntryRequest model and Audit Logs UI Adds GET /eun and PUT /eun endpoints for managing end-user notifications configuration Adds programmatic access endpoints for Malware Protection, ATP, File Type Control, Sandbox, URL Filtering, DNS/IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Cloud Apps, Proxy Gateways, Auth Settings, NSS Feeds, Organization details, Remote Assistance, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Specifically adds CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints for firewall rules: GET|POST|PUT|DELETE /firewallDnsRules and GET|POST|PUT|DELETE /firewallIpsRules Specifically adds CRUD endpoints for file type rules: GET|GET /lite|POST|GET/{ruleId}|PUT/{ruleId}|DELETE /fileTypeRules variants
+9 more
show less
Specifically adds CRUD endpoints for sandbox rules: GET|POST|PUT|DELETE /sandboxRules variants Adds endpoint group for SSL Inspection rules: GET|POST|PUT|DELETE /sslInspectionRules variants Adds NSS Feed management endpoints including validation and connectivity testing: GET|POST|PUT|DELETE /nssFeeds, /feedOutputDefaults, /testConnectivity/{feedId}, /validateFeedFormat Adds organization and subscription info endpoints: GET /orgInformation, /orgInformation/lite, GET /subscriptions Adds proxy gateway info endpoints: GET /proxyGateways, /proxyGateways/lite Adds authentication settings endpoints: GET /authSettings, /authSettings/lite, PUT /authSettings Adds advanced settings endpoints: GET|PUT /advancedUrlFilterAndCloudAppSettings, GET|PUT /advancedSettings Adds Remote Assistance preferences endpoints: GET|PUT /remoteAssistance Extends Tenant Profiles feature to support GitHub application access via enterprise slugs
14 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-11-22
Nov 22, 2024
· release notes
ZDX adds CSV export of roles from the Role Management page
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-20
Nov 20, 2024
· release notes
ZIA adds MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. info to Remediation tab, CSA STAR to Compliance tab in Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. , and GitHub tenant profiles
Adds MITRE MITRE A US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CK ATT&CK A publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tactic and technique information to the Remediation tab in Advanced SSPM's Control Panel Adds CSA STAR compliance framework to the Compliance tab in Advanced SSPM's Control Panel Extends Tenant Profiles support to the GitHub application for specifying enterprise slugs
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-19
Nov 19, 2024
· release notes
ZIA adds GitHub Tenant Profile support and a custom Box connector for granular SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. access.
Extends Tenant Profiles to the GitHub application to provide access to specific enterprise slugs Adds Box Custom Connector support in Administration > SaaS Application Tenants to configure private key JSON files
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-11-19
Nov 19, 2024
· release notes
ZPA PRA Portal adds keyboard language, display, and timezone settings for privileged consoles
Adds keyboard language, display resolution, display quality, and time zone options in the PRA Portal Settings icon to control privileged console properties Adds a collapsible session menu in the Privileged Console with favicon, name, recording, participants, keyboard, full screen, copy, clipboard icons and an End option to terminate the live session
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-18
Nov 18, 2024
· release notes
ZIA release includes updated Executive Insights Mobile App and new Box SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. integration.
Workflow Automation — Release Upgrade Summary (2024) — 2024-11-18
Nov 18, 2024
· release notes
Zscaler Workflow Automation adds resume/retry for CSV imports and improved Property dropdown UI
Adds Resume icon on User Attributes page to restart partial CSV user attribute imports Adds Retry icon on User Attributes page to restart failed CSV user attribute imports (max 3 attempts) Introduces email notifications for CSV import completion, partial completion, and failure statuses Redesigns Property drop-down menu in Workflow, Incident Group, and Event Group Mappings with hierarchy lines, shortened alphabetical names, and frozen header
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-15
Nov 15, 2024
· release notes
ZIA adds DICOM DICOM An open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. inspection, GCP NSS support, new DNS record types, and expanded EDM formats.
Adds %s{edevicehostname} field in NSS/Cloud NSS feeds for Web, Firewall, DNS, and Endpoint DLP logs to output hex-encoded device hostnames Adds %s{app_status} field in NSS/Cloud NSS feeds for web logs to include application status Adds SVCB-compatible type filter option in DNS Logs to match HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. record type transactions Updates WebDlpRule model in /webDlpRules endpoints with FTCATEGORY_JSON, FTCATEGORY_XML, FTCATEGORY_HTTP, and FTCATEGORY_UNK_TXT file types for the fileTypes attribute Adds support for CSYNC, HTTPS, SVCB, and ZONEMD DNS record types in DNS Control policy criteria
+17 more
show less
Adds new failure behavior to DNS Gateways to forward requests to Zscaler Trusted DNS Resolver over TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. when the service is unavailable Expands DLP Exact Data Match (EDM) popular format checks with support for ABA Bank Routing, Aadhaar, CPF, and other international identifiers Enables text extraction and inspection for DICOM files in DLP policies Adds Open Office Presentation (.odp, .otp) and Spreadsheet (.ods, .ots) file type support to DLP policies Expands File Type Control and DLP support to include Outlook Mac (.olm), Publisher (.pub), TNEF (.tnef), OST, PST, LZH, CPIO, Binhex, QuarkXPress, AutoCAD, EXE, DLL DLL A Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. , ELF ELF The standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. , and Domino Database files Enables deployment of NSS virtual machine on Google Cloud Platform (GCP) Adds Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. ) scan capability for Box, Dropbox, and GitLab tenants via the SSPM Scan checkbox during onboarding Adds Gen AI as a new SaaS application category for Data at Rest Scanning DLP and Malware Detection policies, including ChatGPT support Adds Exceptions page for Collaboration applications under Policy > SaaS Security > Data at Rest Scanning to bypass DLP content inspection for specific users/groups/departments Allows admin scope editing for other admins in Authentication Service-enabled tenants via Administration > Administrator Management > Administrators Adds support for Client ID, Client Secret, and Tenant ID configuration in Custom SaaS Connectors for Microsoft SharePoint onboarding Enables specification of file extension (e.g., GZIP) for log data stored in Amazon S3 buckets via Cloud NSS integration Updates Incident Receiver JSON metadata for Endpoint DLP with the department field Updates Incident Receiver JSON metadata for Inline Web DLP with referrerUrl and department fields Updates Incident Receiver JSON metadata for Saas Security DLP with fileModification, collaborationScope, department, numberOfCollaborators, numberOfExternalCollaborators, numberOfRecipients, numberOfExternalRecipients, filePath, fileSize, fileType, documentType, and dlpMD5 fields Adds Application Status filter and column to Web Insights Logs Adds ability to enable End User Notifications for ATP blocks via Show Notification for ATP Blocks under Policy > SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection
22 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-11-15
Nov 15, 2024
· release notes
Risk360 adds Threat Category, Name, URL details to asset risk events and CSV export.
Adds Threat Category , Threat Name , URL Category , and URL Name columns to the Events Contributing to Risk Score for Last 7 Days section in the Asset Details UI Enables exporting all events contributing to risk score changes directly as a CSV file via the Asset Details page
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-11-14
Nov 14, 2024
· release notes
Adds Enterprise RealVNC as a privileged console target in PRA with proprietary protocol support
Enables configuration of Enterprise RealVNC targets as privileged consoles in Privileged Remote Access (PRA)
1 detail in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-11-13
Nov 13, 2024
· release notes
Zscaler Risk360 allows including or excluding items from risk computation via the Investigate page.
Adds ability to include or exclude individual servers and vulnerabilities from risk score computation in the Investigate page
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-12
Nov 12, 2024
· release notes
ZIA adds support for Box Custom Connector using private key JSON and expands File Type Control DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. coverage to new formats.
Expands File Type Control and DLP policies to support Microsoft Outlook Mac Data (.olm), Publisher (.pub), TNEF (.tnef), LZH/CPIO archives, Binhex (.hqx), QuarkXPress (.qxd/.qxp), AutoCAD (.dxf/.dwg), and Domino Server Database (.dxl) file types.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-11-12
Nov 12, 2024
· release notes
Client Connector 3.7.1 adds TPM TPM A dedicated hardware chip, standardized by the Trusted Computing Group, that stores cryptographic keys and measurements in tamper-resistant silicon, giving cyber tools a root of trust that software alone cannot fake. 2.0 support, RPM package management, Maya OS compatibility, and self-signed RPC RPC Remote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. certs for Linux.
Adds Trusted Platform Module (TPM) version 2.0 support Adds RPM Package Manager to install, update, and remove software packages Supports Maya OS platform Supports a self-signed certificate to verify signatures for the RPC protocol
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Upgrades to Linux 3.7.1 must be done with a fresh install for versions of Linux 1.5.0 and earlier.
Business Insights — Release Upgrade Summary (2024) — 2024-11-08
Nov 8, 2024
· release notes
Business Insights gains division mapping, role-based admin, and location IP columns
Adds the ability to map departments to a division in the Business Insights Admin Portal. Adds IP address and ZIA location columns to the Offices and Locations table.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-08
Nov 8, 2024
· release notes
ZIA adds Gen AI DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. scanning, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file management API, GCP NSS support, DICOM DICOM An open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems. DLP extraction, and Standard Firewall DNS insights.
Adds Gen AI as a new SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application category for Data at Rest Scanning DLP and Malware Detection policies. Introduces Cloud Service API endpoints (GET /pacFiles, POST /pacFiles, POST /pacFiles/validate, POST /pacFiles/{pacId}/version/{clonedPacVersion}, GET /pacFiles/{pacId}/version, GET /pacFiles/{pacId}/version/{pacVersion}, DELETE /pacFiles/{pacId}) to manage Zscaler-hosted PAC files. Enables configuration of the SSPM Scan checkbox when onboarding Box, Dropbox, and GitLab tenants for Advanced SaaS Security Posture Management. Adds support for DNS Gateway failure behavior to forward requests to Zscaler Trusted DNS Resolver over TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. or UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. . Adds new DNS record types (CSYNC, HTTPSHTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. , SVCB, ZONEMD) to DNS Control policy criteria and a SVCB-compatible type filter in DNS Logs.
+13 more
show less
Expands DLP File Type support for DICOM files with text extraction of sensitive patient and provider fields. Adds NSS Feeds support for Google Cloud Platform deployment of the NSS virtual machine. Adds %s{edevicehostname} field to NSS/Cloud NSS feeds for Web, Firewall, DNS, and Endpoint DLP logs to output hex-encoded device hostname. Adds Application Status filter and column to Web Insights Logs and %s{app_status} field to NSS Feeds for web logs. Allows configuration of Custom SaaS Connector using Client ID, Client Secret, and Tenant ID (in addition to private key JSON) when onboarding Microsoft SharePoint tenants. Adds ABA Bank Routing Numbers , Austria Social Security Number (ATSSN), Brazil CNPJ , India Aadhaar Card Number , UK National Insurance Number (NINO), and other popular formats as configurable checks in DLP Exact Data Match (EDM). Enables specification of file extension (e.g., GZIP) for log data stored in configured Amazon S3 buckets via Cloud NSS integration. Adds File Type Control and DLP support for new file types: .olm, .pub, .tnef, .ost, .pst, .lha, .cpio, .odp, .ods, .hqx, .qxd/.qxp, .dxf, .dwg, .exe, .dll, .elf, .dxl. Adds File Type Control and DLP support for JSON (.json), XML (.xml), and text files with unknown extensions via FTCATEGORY_JSON, FTCATEGORY_XML, FTCATEGORY_HTTP, FTCATEGORY_UNK_TXT in the /webDlpRules API. Allows Standard Firewall users to view DNS dashboards, insights, and logs within the ZIA Admin Portal. Enables admin editing of other admins' scopes for Authentication Service-enabled tenants via Administration > Administrator Management > Administrators. Adds Exceptions page under Policy > SaaS Security > Data at Rest Scanning for Collaboration applications to bypass content inspection for specific users/groups. Updates UI labels in ZIA Admin Portal for Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. (e.g., SaaS Security API to SaaS Security, 3rd Party Applications to 3rd-Party App Governance).
18 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-11-08
Nov 8, 2024
· release notes
ZDX Copilot gains graph/chart visualizations and expanded diagnostics for Wi-Fi, ISP, DC, endpoint, and call quality.
Adds graph and chart visualizations to ZDX Copilot analytics for more accurate data summarization with better context Expands ZDX Copilot diagnostics support to Wi-Fi, internet service provider (ISP), data center (DC), endpoint, and call quality issues
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-11-08
Nov 8, 2024
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. now supports granular IP address protocol ranges in forwarding profiles
Enables granularity in inclusion and exclusion policies by allowing you to enter an IP address:port range or an IP address protocol range.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-06
Nov 6, 2024
· release notes
ZIA adds Box custom SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. connector support and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. trigger context in notifications.
Adds private key JSON configuration for Box SaaS Application Tenants to grant minimal permissions instead of full administrator privileges Adds 15-byte prefix and suffix context to DLP triggers in Incident Receiver, Zscaler Workflow Automation, and Email Notifications
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-05
Nov 5, 2024
· release notes
ZIA adds Tenant filter across App Inventory, Posture, Users pages in Third-Party App Governance.
Adds multi-tenant selection buttons in the Integrations banner for 3rd-Party App Governance platforms Enables viewing and changing status of findings on the User Panel Findings tab Renames the User Findings column to Findings on the Users page in 3rd-Party App Governance
3 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-11-04
Nov 4, 2024
· release notes
Zscaler Workflow Automation adds CSV user attribute imports, new AWS DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. CloudFormation CloudFormation An AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. parameters, and incident detail enhancements.
Adds a User Attributes page in the Admin Portal to import end user attributes via CSV file Adds Primary User Data Source (SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. or CSV) and Unique Identifier options to Account Settings for fetching user attributes Adds an Additional Information section to the Incident Details page to display end user, manager, and address data from the primary source Expands Property lists on Incident Group Mapping and Workflow Mapping pages with userInfo, managerInfo, and userInfo.Skip Level Managers properties Adds support for creating AWS DLP integration resources via a CloudFormation stack template
5 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-11-04
Nov 4, 2024
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds malware detection policies, region-scoped onboarding, EBS EBS Amazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. scan caching, and investigation predicates.
Adds Malware Predicates (Malware Name, Malware Category, Detection Accuracy Level) to investigation queries for checking resource presence of malware Adds Resource Property Predicate using the And operator to check multiple attributes in a metadata array Adds new AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role resource types: IAM Role , IAM Unmanaged Role , and IAM External Role as queryable resource types Adds support for Predefined Lists of regions and vulnerabilities in policy predicates Enables specifying monitored regions during cloud account onboarding to limit scanner instance deployment and role creation
+3 more
show less
Enhances dashboard with Risk and Data Discovery tabs, including Risk Score trend chart Updates data inventory table layout for focused object viewing Adds new data posture policies for AWS (S3, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. ), Azure (VM, Storage, SQL, Entra ID Entra ID Microsoft's cloud-based identity and access management service, formerly Azure Active Directory, used by cyber tools to authenticate users and enforce access policies in Microsoft 365 and Azure environments. ), and GCP (Storage Bucket)
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-11-01
Nov 1, 2024
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. trigger context, GCP NSS support, DICOM DICOM An open standard for storing and transmitting medical imaging data, maintained by NEMA, that defines both the file format and network protocol used to exchange scans between clinical systems. /DLP file types, Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for Box/Dropbox/GitLab, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file APIs, and DNS TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fallback.
Adds %s{edevicehostname} field to NSS/Cloud NSS feeds (Web, Firewall, DNS, Endpoint DLP) for hex-encoded device hostnames Adds NSS support for Google Cloud Platform (GCP) deployment Adds Application Status filter and column to Web Insights Logs in the ZIA Admin Portal Adds %s{app_status} field to NSS Feeds for web logs Adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) Advanced Scan support for Box, Dropbox, and GitLab tenants via onboarding checkbox
+8 more
show less
Expands DLP Exact Data Match (EDM) Popular Format Check with new supported data types including international tax IDs, passport numbers, and credit cards Adds new file type support for DLP/FTC: .olm, .pub, .tnef, .ost, .pst, .lha, .cpio, .odp, .ods, .hqx, .qxd, .qxp, .dxf, .dwg, .exe, .dll, .elf, .dxl, .otp, .ots, and DICOM with text extraction Adds new endpoints to the Cloud Service API for Zscaler-hosted PAC files: GET /pacFiles, POST /pacFiles, POST /pacFiles/validate, POST /pacFiles/{pacId}/version/{clonedPacVersion}, GET /pacFiles/{pacId}/version, GET /pacFiles/{pacId}/version/{pacVersion}, DELETE /pacFiles/{pacId} Adds new file types to the fileTypes attribute in WebDlpRule model via /webDlpRules endpoints: FTCATEGORY_JSON, FTCATEGORY_XML, FTCATEGORY_HTTP, FTCATEGORY_UNK_TXT Enables DNS Gateway to forward requests to Zscaler Trusted DNS Resolver over TCP or UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. when the configured DNS service is unavailable or unhealthy Adds CSYNC, HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. , SVCB, and ZONEMD record types to DNS Control policy criteria and a new SVCB-compatible filter option in DNS Logs Adds Web Insights Isolation Policy Reason filter and Policy Reason widget in Browser Isolation Consumption Reports Enables admin scope editing for Authentication Service-enabled tenants via Administration > Administrator Management > Administrators page
13 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-11-01
Nov 1, 2024
· release notes
Private Access introduces Conditional Access Conditional Access A policy enforcement framework, most commonly Microsoft's in Entra ID, that grants or blocks resource access based on signals like user identity, device state, and location — letting cyber tools trigger step-up auth or deny risky sessions. rule action to replace Require Approval for privileged access
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-11-01
Nov 1, 2024
· release notes
Cloud & Branch Connector adds IP protocol granularity to VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. forwarding inclusion and exclusion policies
Enables entry of an IP address:port range or IP address:port:protocol range in VDI forwarding inclusion and exclusion policies
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-10-31
Oct 31, 2024
· release notes
ZPA adds PRA File Transfer System enabling file uploads in PRA Portal with ZIA Sandbox scanning
Enables users to upload files via the My Files page of the PRA Portal Allows admins to assign portals policy rules to enable file deletion for uploaded files Integrates with Zscaler Internet Access (ZIA) cloud Sandbox to scan uploaded files
3 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-10-31
Oct 31, 2024
· release notes
Risk360 now supports scanning multiple domains to quantify external surface risk.
Adds multiple domains support in the Risk360 Admin Portal for scanning and quantifying publicly exposed assets Visualizes the aggregated risk assessment as risk factors which can be drilled down via the investigate page
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-30
Oct 30, 2024
· release notes
Custom End User Notification messages available for inline Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. on macOS
└──▷ HOW TO FIND IT
Configure a custom alert to appear in the Zscaler Client Connector tray when a user triggers a DLP rule.
📍 Administration › End User Notifications › Client Connector
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-10-30
Oct 30, 2024
· release notes
The 2024-10-30 update enables iOS device monitoring in ZDX.
Client Connector — ZDX Module Release Summary (2024) — 2024-10-30
Oct 30, 2024
· release notes
ZDX Module for iOS gains Web/traceroute probes and device stats in v3.6
Adds Web probes support for ZIA and ZPA connectivity diagnostics Adds traceroute probes using ICMP for ZIA network path analysis Adds device statistics and device profiles collection capabilities Adds password to disable the ZDX service configuration option
4 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-10-30
Oct 30, 2024
· release notes
Zscaler Client Connector 3.8 for iOS adds ZDX support, per-app VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. , and skip.authByTunnel config
Adds authByTunnel=1 config parameter to enable passwordless enrollment for ZIA-only and ZIA + ZPA users via the Portal IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Adds External Device ID value in Device Details screen Adds support for wildcard (*) ZPA application segments Includes support for Digital Experience (ZDX) on iOS devices Supports per app VPN access for Zscaler Private Access (ZPA) apps along with Enterprise VPN for Zscaler Internet Access (ZIA) on iOS devices
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Requires Tunnel SDK 3.8 (previously 3.7); by default, Tunnel SDK 1.9 is enabled and must be changed by contacting Zscaler Support to enable SDK 3.8
Client Connector — Client Connector App Release Summary (2024) — 2024-10-29
Oct 29, 2024
· release notes
Zscaler Client Connector 3.7 adds ZDX for Federal cloud, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. dropping in Forwarding Profiles, OS Version posture type, and secondary DNS fallback.
Adds OS Version device posture type for assigning specific entitlements to devices based on posture. Supports separate one-time passwords (OTPs) for the logout and uninstall functions in Zscaler Client Connector. Adds the ability for Zscaler Client Connector to fall back to a secondary DNS. Includes the ability to drop IPv6 traffic when configuring Forwarding Profiles for Zscaler Client Connector. Adds Digital Experience (ZDX) support for the Federal cloud.
5 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-10-29
Oct 29, 2024
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds malware predicates, EBS EBS Amazon's block-storage service for EC2 instances, providing persistent network-attached volumes that survive instance restarts and can be snapshotted, giving cyber tools durable, scalable disk without managing physical drives. scan caching, region-scoped onboarding, and new data posture policies for AWS/Azure/GCP
Adds Has Malware , Malware Name , Malware Category , and Detection Accuracy Level predicates to investigation queries and custom policies. Adds scanner cache for EBS volumes attached to multiple EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. instances or Auto Scaling groups to reduce scan cost and improve performance. Adds region selection during onboarding of AWS Organizations, Microsoft Entra Tenants, and GCP Organizations to limit scanner instance deployment. Adds Resource Property Predicate supporting the And operator for multiple attributes in a metadata array. Adds three new AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. Role resource types: IAM Role , IAM Unmanaged Role , and IAM External Role .
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-10-28
Oct 28, 2024
· release notes
Adds Workload Groups as a criteria for Access Policy in Zscaler Private Access.
Enables selection of Workload Groups as a criterion for access policy to apply security policies for cloud workloads on public cloud providers.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-25
Oct 25, 2024
· release notes
ZIA adds Advanced SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. capabilities, Endpoint Data Scan Report, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file management API, and new isolation analytics filters.
Adds GET /pacFiles, POST /pacFiles, POST /pacFiles/validate, POST /pacFiles/{pacId}/version/{clonedPacVersion}, GET /pacFiles/{pacId}/version, GET /pacFiles/{pacId}/version/{pacVersion}, and DELETE /pacFiles/{pacId} endpoints to manage Zscaler-hosted PAC files via Cloud Service API. Adds the Endpoint Data Scan Report for visibility into sensitive data stored locally on connected endpoints, with drill-down by user. Adds Advanced SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) features including 3rd-Party App Governance and configuration drift management. Adds Policy Reason as a new Web Insights filter for Isolation Policy in ZIA Analytics. Adds a new widget for Policy Reason in Browser Isolation Consumption Reports within ZIA Analytics.
5 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2024) — 2024-10-25
Oct 25, 2024
· release notes
ZPA Private Service Edge 24.566.2 adds Business Continuity support and refined Client-to-Client connection promotion.
Adds Business Continuity support to ZPA Private Service Edge, enabling resilient connectivity during outages. Enhances Private Service Edge logic to promote only Client-to-Client connections when overlapping Client Hostname Validation and application segments are configured.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-10-25
Oct 25, 2024
· release notes
ZDX adds alert rule templates for Zscaler Hosted Probes and new filters in Data Explorer
Adds the ability to create alert rule templates on the Templates page to prefill prefill The first phase of inference, where the model reads the whole prompt in parallel before producing its first token. It drives time-to-first-token; decode is the token-by-token phase after it. criteria for Zscaler Hosted probes Adds additional filters and group options in Data Explorer configuration
2 details in Everything
Client Connector — Release Upgrade Summary (2024) — 2024-10-25
Oct 25, 2024
· release notes
Zscaler Client Connector Portal 4.3 adds Last Seen Connected to ZPA status for ZPA-only customers.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-10-22
Oct 22, 2024
· release notes
Private Access adds Kubernetes support for App Connector on private.zscaler.com and zpatwo.net.
Adds Kubernetes Support for App Connector as a new deployment platform for the App Connector agent.
1 detail in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-10-21
Oct 21, 2024
· release notes
Cloud & Branch Connector now supports ZPA access policies for Cloud Connector Workload Groups.
Business Insights — Release Upgrade Summary (2024) — 2024-10-18
Oct 18, 2024
· release notes
Adds CSV export from the All Applications page in Business Insights.
Enables exporting all applications data to a CSV file from the All Applications page
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-10-18
Oct 18, 2024
· release notes
Workflow Automation now allows post-closure incident actions and configurable approvers in specific workflow templates.
Adds Assign DLP Admin , Assign to Me , Assign Priority , Notify User , and Label actions for resolved incidents via the Incidents page Actions drop-down Enables selection of an approver from the Approver Name drop-down when creating workflows using the Auto Escalate, Auto Notify User and Escalate, or Auto Notify User and Concurrently Escalate templates
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-10-17
Oct 17, 2024
· release notes
ZPA adds visual indicators for isolated web pages via border and icon changes.
Adds a blue rectangular border around isolated web pages to indicate isolation state Prefixes the isolated tab name with a lock icon ' ' on supported browsers or '#' on unsupported ones
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-16
Oct 16, 2024
· release notes
ZIA adds Confirm action for Inline Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , granular AI/ML controls, and EUN localization.
Adds Confirm action to Inline Web DLP policy rules to allow users to justify or cancel transactions Extends granular control actions in the Add AI & ML Rule window for Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway Adds localization support (Chinese Traditional, French, German, Japanese, Spanish) for Endpoint DLP end user notification messages
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-15
Oct 15, 2024
· release notes
ZIA adds GPU GPU A graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. -based Turbo Mode for Isolation and granular AI/ML app controls
Adds Turbo Mode for Isolation to enable GPU-accelerated rendering in isolation profiles Extends granular action controls to Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway applications
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-14
Oct 14, 2024
· release notes
ZIA adds granular action controls for Google Gemini, Copilot, Perplexity, Poe, and Runway.
Adds granular actions (Chatting, Downloading, Renaming) to the Add AI & ML Rule window for Google Gemini Adds granular actions (Chatting, Deleting, Renaming, Sharing, Uploading) to the Add AI & ML Rule window for Microsoft Copilot Adds granular actions (Chatting, Deleting, Sharing, Uploading) to the Add AI & ML Rule window for Perplexity Adds granular actions (Chatting, Deleting, Sharing, Uploading) to the Add AI & ML Rule window for Poe Adds granular actions (Creating, Deleting, Downloading, Renaming, Sharing) to the Add AI & ML Rule window for Runway
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-10-14
Oct 14, 2024
· release notes
ZPA adds Turbo Mode for Isolation to leverage GPU GPU A graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. rendering and reduce bandwidth
Adds Turbo Mode for Isolation feature that uses the user's GPU to capture and replay rendering instructions instead of pixel streaming. Enables enabling Turbo Mode for Isolation per isolation profile in ZPA.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-10-11
Oct 11, 2024
· release notes
ZDX adds Incident alert rule type and macOS Self Service support; extends Remote Assistance time limits to 90 days.
Incident is now available as an Alert Rule type for configuring alertsSelf Service configuration via the ZDX module supports macOS devices (requires Zscaler Client Connector v4.3.1+ and ZDX Module v3.9+) Remote Assistance time limit extended to 90 days for both view-only and full access modes
3 details in Everything
Authentication Service — Release Upgrade Summary (2024) — 2024-10-11
Oct 11, 2024
· release notes
Authentication Service now mandates immediate MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enrollment, supports OpenID Connect OpenID Connect OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. step-up authentication via ACR claims, and allows access token access token A credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. revocation for API client
Removes the option to skip MFA enrollment for a default grace period, requiring admins to enroll immediately upon first login Adds support for Step-Up Authentication over OpenID OpenID An open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Connect with external IdPs, allowing configuration of authentication levels and mapping them to ACR claims Enables revoking access tokens access tokens A credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. assigned to API clients accessing Zscaler service API resources
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The option to skip MFA enrollment for a default grace period is no longer available, requiring admins to enroll immediately upon first login
Cloud & Branch Connector — Zscaler Client Connector for VDI Release Summary (2024) — 2024-10-09
Oct 9, 2024
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. adds port and protocol forwarding support in v1.4.0.5
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-07
Oct 7, 2024
· release notes
ZIA adds localized End User Notifications for Endpoint and Inline Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , DLP rule support for LibreOffice/Edge print jobs, and ATP blocking notifications.
Adds localized (Chinese Traditional, French, German, Japanese, Spanish) end user notification messages for Endpoint DLP policy enforcement Adds a Confirm action to Inline Web DLP policy rules, allowing users to justify or cancel blocked transactions with a localized confirmation message Extends Endpoint DLP policy rule application to print jobs in LibreOffice, Chrome, and Microsoft Edge
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-10-04
Oct 4, 2024
· release notes
ZIA adds SSN inclusion/exclusion attributes to API, HTTP GET query param DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. inspection, Slack file restore, non-delimited Unicode DLP, IR health checks, and .zipx/.ost suppo
includeSsnNumbers and ssnNumbers API attributes for the predefined DLP Social Security Numbers (US) dictionary on zscalertwo.net and zscalerthree.net to include or exclude specific SSNs.UI toggle to enable HTTP GET query parameter inspection in DLP rules, available from the DLP page drop-down menu for URL categories. Checkbox option to enable Non-delimited Unicode phrase matching when adding custom DLP dictionaries. New health status JSON file (<systmld>_<iphash>_ir_health_status_timestamp.json) produced by the Zscaler Incident Receiver, running every 5 minutes by default.
4 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-10-03
Oct 3, 2024
· release notes
Workflow Automation adds Authentication Service login, enhanced Data Protection workflow fields, and detailed user count in event insights.
Adds Authentication Service integration allowing admins to log in to Workflow Automation from the Authentication Service Admin Portal Enhances Auto Create Tickets workflow with Jira Project and Default Ticket Assignee Email fields for automated ticketing configuration Adds Users Count By Plan Type field on Event Details page to show impacted user counts per plan type
3 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-09-30
Sep 30, 2024
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds malware scanning, custom resource tags, GCP Storage support, and enhanced query predicates.
Adds malware scanning capability for file-based data stores (AWS S3, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , Azure Storage/VM, GCP Storage) selectable in scan settings. Adds the ability to add custom tags to DSPM-created resources during cloud account onboarding for grouping and billing. Adds support for onboarding and scanning Google Cloud Platform (GCP) Cloud Storage buckets and managed folders. Adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Engine filter to alert notifications and ignore alert filters. Adds Azure App Services as a resource type for investigation and policy queries.
+5 more
show less
Adds Action over Parent Resource and Access Level over Parent Resource predicates for querying parent data store permissions. Adds Include In (⊆) operator for CVE severity values in investigation and policy queries. Adds IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Users, Unmanaged Users, and External Users as resource types in investigation and custom policy queries. Adds Like (%) and Not Like (! (%)) operators with wildcard support for string predicates. Enables identification of external and internal cross-account/cross-organization access paths in investigations and custom policies.
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-27
Sep 27, 2024
· release notes
ZIA adds Block No-SNI SNI A TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. toggle, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. watermarks, HTTP GET param inspection, Unicode phrase matching, SSN dict control, Slack file restore, and IR health checks.
Adds Block No Server Name Indication (SNI) toggle under Policies > SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection > Add SSL Inspection Rule to block traffic lacking SNI in Client Hello Enables DLP watermarks for file sharing via the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API, with removal of applied watermarks available as a remediation action on the Assets with Incidents page Adds includeSsnNumbers and ssnNumbers attributes to cloud service API endpoints for editing predefined DLP Social Security Numbers (US) dictionaries Enables inspection of HTTP GET Query Parameters for sensitive data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. detection via a new toggle on the DLP page Enables Non-delimited Unicode phrase matching in the Add DLP Dictionary window, allowing matches against strings without delimiters
+3 more
show less
Adds Restore option as a remediation action for quarantined Slack files on the SaaS Assets Report > Assets with Incidents page Enables Zscaler Incident Receiver health check by default, producing <systmld>_<iphash>_ir_health_status_timestamp.json files in the evidence folder every 5 minutes Increases limit for Zscaler Private Access application segments to 2,000 when configuring Source IP Anchoring in the ZIA Admin Portal
8 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-09-27
Sep 27, 2024
· release notes
ZDX adds Wi-Fi name visibility controls and a new PSE Health Dashboard to the Admin Portal.
Adds Wi-Fi Name visibility toggle under Device and User Information permissions for ZDX roles and sharing snapshots Adds ZIA Private Service Edge (PSE) Health Dashboard providing statistical overview of data center PSEs including traffic, latency, and transactions over 24 hours to 14 days Updates ZDX Admin Portal UI design with new color palette and typography
3 details in Everything
Client Connector — ZDX Module Release Summary (2024) — 2024-09-26
Sep 26, 2024
· release notes
ZDX Module 3.9 adds remote bandwidth testing, traceroute through proxies, and ZPA TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. /UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. probing.
Enables remote bandwidth testing via a Diagnostics session in ZDX Supports traceroutes through external proxy Enhances the Zscaler Private Access (ZPA) Cloud Path to support TCP and UDP protocols for probing from the client to the Zscaler Private Service Edge
3 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-09-26
Sep 26, 2024
· release notes
Zscaler Client Connector adds Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. notification support and Self Service diagnostic capabilities on macOS.
Adds support for sending ZIA DLP notifications via Endpoint DLP if Endpoint DLP is enabled Adds Self Service to improve end user experience by diagnosing and providing recommendations to resolve issues due to high CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage and poor Wi-Fi connection
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-09-26
Sep 26, 2024
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. 2024 upgrade introduces custom tagging for resources, new query operators (Like/Not Like) and predicates (Parent Resource), granular IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. filtering (Unmanaged/External Users), DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine alert filters, and security hardening by gating scanner updates via private endpoints.
Adds Custom Tags capability to DSPM resources for grouping, billing, and security controls Adds Malware Scanning for file-based data stores (S3, EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. , Azure Storage, VM, GCP) Adds new Data Posture Policies for AWS RDS/S3, Azure VM/Storage, and GCP Storage buckets Adds DLP Engine filter to alert notifications and ignore filters Adds Like (%), ! (%) , and [!(%)] operators for wildcard string matching in queries
+4 more
show less
Adds Action over Parent Resource and Access Level over Parent Resource predicates Adds support for onboarding Azure App Services as a resource type in investigations Adds Unmanaged Users and External Users IAM resource types for granular query filtering Gates scanner update service behind Zscaler private endpoints, restricting outbound orchestrator connections
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-25
Sep 25, 2024
· release notes
ZIA adds granular action controls for Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway.
Adds granular actions (Chatting, Downloading, Renaming, etc.) for Google Gemini in the Add AI & ML Rule window Adds granular actions (Chatting, Deleting, Renaming, Sharing, Uploading) for Microsoft Copilot in the Add AI & ML Rule window Adds granular actions (Chatting, Deleting, Sharing, and Uploading) for Perplexity in the Add AI & ML Rule window Adds granular actions (Chatting, Deleting, Sharing, and Uploading) for Poe in the Add AI & ML Rule window Adds granular actions (Creating, Deleting, Downloading, Renaming, and Sharing) for Runway in the Add AI & ML Rule window
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-23
Sep 23, 2024
· release notes
ZIA adds language translation in isolation profiles and granular controls for AI/ML app actions.
Adds Language Translation in Isolation profile setting to enable Google Translate within isolated sessions via the isolation bar or right-click menu. Extends granular action controls (Chatting, Downloading, Renaming, etc.) to Google Gemini, Microsoft Copilot, Perplexity, Poe, and Runway in the Add AI & ML Rule window.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-23
Sep 23, 2024
· release notes
Predefined DNS/forwarding rules and DHCP lease time increases for Zero Trust Branch Devices
predefined DNS rule and three predefined traffic forwarding rules added to Zscaler Cloud & Branch Connector Admin Portal for gateway-mode devicesdefault DHCP lease time increased from 600 seconds to 86400 seconds in branch configuration templates maximum DHCP lease time increased from 86400 seconds to 604800 seconds in branch configuration templates DHCP Options section now supports specifying up to 4 domain names and 4 DNS servers peer DHCP configuration now supported when high availability (HA) is enabled
+1 more
show less
Zscaler Cloud & Branch Connector Admin Portal now exposes monitoring for ZIA gateway tunnel and ZPA broker tunnel data
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-20
Sep 20, 2024
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. SSN dictionary control via API attributes, GET param inspection, Slack file restore, and Incident Receiver health check files.
Adds includeSsnNumbers and ssnNumbers attributes to the cloud service API for managing predefined DLP Social Security Numbers (US) dictionary matches Enables DLP inspection on HTTP GET Query Parameters via the Inspect HTTP GET Query Parameters toggle in the DLP page UI Adds a Restore remediation action for quarantined Slack files in the Incidents section of the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report Produces _ir_health_status_timestamp.json files in the evidence folder from the Incident Receiver health check feature
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-09-20
Sep 20, 2024
· release notes
ZPA introduces Zscaler Microsegmentation for host-based application segmentation and flow visualization.
Adds Zscaler Microsegmentation capability to perform granular segmentation of private applications via agents and cloud telemetry Enables visualization of private application inventory and flows within the ZPA Admin Portal
2 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-09-19
Sep 19, 2024
· release notes
Zscaler Workflow Automation adds Closed event status and Filewatcher health alerts
Adds Closed as a new event status option on the Events page for tracking resolved issues. Removes Customer ID prefix from Event ID field format for Business Insights events in Admin Portal. Adds Close Event action to Actions drop-down menu on Event Details page for Business Insights events. Enables running run-filewatcher.sh bash script in Azure DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. integration to install/upgrade Filewatcher container using Docker or Podman. Adds health alert notification for Filewatcher on Notifications Center page when status is unhealthy.
5 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-17
Sep 17, 2024
· release notes
Zscaler Cloud & Branch Connector now supports deployment via AMI in AWS China (Beijing and Ningxia) regions
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-16
Sep 16, 2024
· release notes
New predefined DNS/forwarding rules and DHCP enhancements for Zscaler Cloud & Branch Connector gateway mode
Adds one predefined DNS rule and three predefined traffic forwarding rules to the Admin Portal for Zero Trust Branch Devices in gateway mode Increases default DHCP lease time from 600s to 86400s and maximum lease time from 86400s to 604800s for branch configuration templates Allows specifying up to 4 domain names and 4 DNS servers in the DHCP Options section of branch configuration templates Enables configuring peer DHCP when high availability (HA) is enabled for Zero Trust Branch Devices in gateway mode Adds monitoring capability for ZIA gateway tunnel and ZPA broker tunnel data for Zero Trust Branch Devices in gateway mode
5 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-09-13
Sep 13, 2024
· release notes
Business Insights adds workplace occupancy/attendance goals and enhanced chart metrics for organizational oversight.
Adds Occupancy and Attendance Goals tab to Workplace Settings page for configuring organization and office-level goals Adds Occupancy Goal and Attendance Goal columns to the Configured Offices page in Workplace > Workplace Settings Adds Occupancy Goal Percentage and Attendance Goal Percentage fields to the Add Office and Edit Office drawers Enables viewing occupancy and attendance chart metrics in configurable units (numerical value, percentage) within Workplace Insights
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-13
Sep 13, 2024
· release notes
ZIA adds Gen AI prompt configuration, a new Analytics page for Gen AI reports, and a Prompt filter in Web Insights Logs.
Adds the Gen AI Prompt Configuration section to the Policy > URL Filtering & Cloud App Control > Advanced Policy Settings page for enabling and categorizing prompts for ChatGPT, Google Gemini, Perplexity, Poe, and Meta AI Adds a new Analytics > Gen AI Security Report page to monitor and view logs for generative AI usage Adds the Insert XFF Header for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspected Traffic field on the Advanced Settings page to control XFF header insertion for traffic forwarded from ZIA to Zscaler Private Access
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-09-13
Sep 13, 2024
· release notes
Adds ZDX Snapshot feature to generate shareable view-only URLs for Incident details
ZDX Snapshot feature provides a URL that you can share with ZDX users for view-only access to an Incidents dashboard or specific Incident details page.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-09-11
Sep 11, 2024
· release notes
ZPA adds Red Hat Enterprise Linux 9 App Connector and PSE images for Google Cloud Platform on zpatwo.net
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-11
Sep 11, 2024
· release notes
Adds Zscaler Branch Connector deployment support on Microsoft Hyper-V
Risk360 — Release Upgrade Summary (2024) — 2024-09-10
Sep 10, 2024
· release notes
Zscaler Risk360 adds Decoy Domain filtering for investigating External Surface Attack problem cards
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-09
Sep 9, 2024
· release notes
ZIA adds Federation Broker mode support for Okta apps in Third-Party App Governance.
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-09
Sep 9, 2024
· release notes
Zscaler Branch Connector adds Hyper-V deployment support and App Segments granularity to traffic forwarding rules
Adds support for deploying Zscaler Branch Connector on the Microsoft Hyper-V platform. Adds App segments configuration option in Traffic Forwarding Rules to enable granular control by selecting specific application segments or segment groups.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-06
Sep 6, 2024
· release notes
ZIA adds Smartsheet tenant support, XFF header insertion for ZPA traffic, and remote access download controls in Malware Protection policy.
Adds Insert XFF Header for SSL Inspected Traffic field in Advanced Settings to insert XFF headers for traffic forwarded from ZIA to Zscaler Private Access (ZPA). Adds Smartsheet tenant configuration support via the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API. Adds ability to allow or block downloads from remote access sites in Malware Protection policy.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-09-06
Sep 6, 2024
· release notes
ZPA allows up to 380 days for auth disaster recovery and adds account profile editing
Supports a maximum value of 380 days for the Max Age for Authentication field in Disaster Recovery Settings Allows ZPA Admin Portal users to update their language, time zone, and password directly from the Account section
2 details in Everything
Client Connector — Release Upgrade Summary (2024) — 2024-09-06
Sep 6, 2024
· release notes
Zscaler Client Connector Portal 4.2.1 adds automated device cleanup and a new UI skin
Adds the ability to remove older devices after user enrollment for ZPA-only customers via Configuring Automated Device Cleanup settings. Includes a configurable device limit per user for ZPA-only customers controlling the automated device removal scope. Introduces support for the new reskinned Zscaler Client Connector Portal UI. Removes the OneID Admins tab in Zscaler Client Connector Portal.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The OneID Admins tab is removed from the Zscaler Client Connector Portal interface.
Workflow Automation — Release Upgrade Summary (2024) — 2024-09-05
Sep 5, 2024
· release notes
Zscaler Workflow Automation adds privacy toggles for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident fields and new filters on the Incidents page.
Adds Hide Evidence Data , Hide Trigger Data , and Hide Policy Details fields to DLP integration pages to control visibility for admins, end users, and managers/approvers. Adds Department , Document Type , File Source Location , and Referrer URL filters to the Incidents page with multi-value support for specific fields.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-05
Sep 5, 2024
· release notes
Cloud & Branch Connector adds Azure VMSS support and Hyper-V branch deployment (2024-09-05)
Cloud Connector supports Virtual Machine Scale Sets (VMSS) deployment on Microsoft Azure, controlled via the Zscaler Admin Console where Auto Scaling now refers to VMSS.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-04
Sep 4, 2024
· release notes
ZIA adds granular action controls for ChatGPT, Webex, Slack, SharePoint, Teams, and LinkedIn in Cloud App Control.
Adds Chatting , Uploading , Downloading , Deleting , Sharing , and Inviting actions for the ChatGPT application in Cloud App Control AI & ML Rules Adds Sharing , Editing , Creating , Downloading , Chatting , Uploading , Inviting , and Meeting actions for Webex Meetings in Cloud App Control Collaboration Rules Adds Editing , Creating , Downloading , Deleting , Chatting , Uploading , Inviting , and Huddle actions for Slack in Cloud App Control Collaboration Rules Adds Sharing , Editing , Renaming , Creating , Downloading , Deleting , and Uploading actions for SharePoint Online in Cloud App Control Collaboration Rules Adds Chatting and Screen Sharing actions for Microsoft Teams in Cloud App Control Collaboration Rules
+1 more
show less
Adds Posting , Chatting , Sharing , Editing , Commenting , Uploading , and Creating actions for LinkedIn in Cloud App Control Social Networking Rules
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-09-03
Sep 3, 2024
· release notes
ZIA adds active/deactivated/risky app counts and user impact to the 3rd-Party App Governance dashboard, plus Zoom, Webex, and Box support in the governance catalog.
The 3rd-Party App Governance Dashboard now displays an overview of all active and deactivated apps across your business, including counts for active, deactivated, and risky apps as well as affected users over a specific time period. The 3rd-Party App Governance Catalog now supports Zoom, Webex, and Box apps, allowing you to search for, pre-vet, and manage these applications and upload them to your inventory.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-09-03
Sep 3, 2024
· release notes
New API surface for managing segment groups.
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-09-03
Sep 3, 2024
· release notes
Zscaler Branch Connector now supports Hyper-V deployment and App Segments in traffic forwarding rules.
Adds support for deploying Zscaler Branch Connector on the Microsoft Hyper-V platform. Enables configuration of application segments (and segment groups) within Traffic Forwarding Rules for granular policy control.
2 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-08-30
Aug 30, 2024
· release notes
Business Insights adds CSV export for Top Cities, scheduled email reports, Workflow Automation, and custom app signatures.
Adds the ability to configure and pull data from specific application URLs using custom application signatures Enables exporting the Top Cities widget data to a CSV file from the Workplace Insights page Supports scheduling reports for application activity or inactivity data with weekly, monthly, or quarterly email distribution Integrates Business Insights incidents with third-party Workflow Automation for actions like application license reclaim
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-30
Aug 30, 2024
· release notes
ZIA enhances Malware Protection Policy with targeted download controls for remote access tools and adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. support for Microsoft Cloud App Security partner integration.
└──▷ BREAKING ON UPGRADE
! Existing MCAS partner integrations using token-based authentication can no longer have configuration changes made to them; Zscaler recommends converting to OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0, after which the Token option is no longer available.! New token-based MCAS integrations are not available as an option in the portal.
Workflow Automation — Release Upgrade Summary (2024) — 2024-08-30
Aug 30, 2024
· release notes
Workflow Automation adds integration with Business Insights for automated license management tickets.
Adds Workflow Automation integration with Business Insights to view and manage events for underutilized SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application licenses Enables configuring workflows that automatically trigger tickets through a ticketing system for resolving Business Insights events
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-08-30
Aug 30, 2024
· release notes
Adds email address as ServiceNow User ID and Network applications using Cloud Path probes for ZDX monitoring
Allows email addresses to be used as the User ID when configuring a Service User Role on ServiceNow for ZDX Adds support for Network applications configured with only a single Cloud Path probe (no Web probe required), calculating ZDX Scores using End-to-End Latency
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-08-30
Aug 30, 2024
· release notes
Zscaler Cloud Connector AMI v24.3.1 available in AWS China (Beijing/Ningxia) with updated Terraform templates
Client Connector — Release Upgrade Summary (2024) — 2024-08-30
Aug 30, 2024
· release notes
Zscaler Client Connector Portal adds automated device cleanup for ZPA-only customers and a new UI skin.
Adds the ability to remove older devices after user enrollment for ZPA-only customers via Configuring Automated Device Cleanup Includes support for a device limit per user when removing older devices from the ZPA Admin Portal Introduces the new reskinned Zscaler Client Connector Portal UI
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the OneID Admins tab in Zscaler Client Connector Portal
Client Connector — Client Connector App Release Summary (2024) — 2024-08-27
Aug 27, 2024
· release notes
Adds Ignore Client Cert errors for WebView2 option to skip certificate failures in embedded auth workflows.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-08-26
Aug 26, 2024
· release notes
Adds SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. /SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attribute-based criteria for ZPA redirection policies via UI and API.
SAML and SCIM attributes are now available as criteria in ZPA Redirection Policy rules to prefer Private Service Edges over Public Service EdgesThe cloud service API endpoints for configuring Redirection Policies have been updated to support these new attribute-based criteria
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-08-26
Aug 26, 2024
· release notes
Adds Azure China Marketplace deployment for Zscaler Cloud Connector and AWS account tagging support.
Enables deployment of Zscaler Cloud Connector via the Azure China Marketplace using Terraform templates Supports user-defined tags across Amazon Web Services accounts in cross-account deployments
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-23
Aug 23, 2024
· release notes
ZIA adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. for MCAS, explicit proxy DNS tunneling, EDM format checks, new API endpoints, and traffic capture on allow policies.
Adds dnsoverproxy flag to NSS configuration to tunnel Zscaler cloud-bound connections without internet-facing DNS resolution Adds OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 authentication method for Microsoft Cloud App Security (MCAS) partner integration via Administration > Partner Integrations Adds EDM Popular Format Check to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Advanced Settings to restrict Exact Data Match to SSN, CCN, and CSIN formats Adds fields %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} to NSS Web log Feed Output Format for Server Destination Port and Other DLP Rules logging Adds field %s{pcapid} to NSS Web, Firewall, and DNS feeds for PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file path output
+5 more
show less
Enables Traffic Capture for IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control and Advanced Threat Protection policies when action is set to Allow Adds GET /webApplicationRules/ruleTypeMapping and /webApplicationRules/{rule_type} endpoints to Cloud App Control Policies API Adds POST /webApplicationRules/{rule_type}, POST /webApplicationRules/{rule_type}/availableActions, POST /webApplicationRules/{rule_type}/duplicate/{ruleId}, POST /webApplicationRules/{rule_type}/{ruleId}, PUT /webApplicationRules/{rule_type}/{ruleId}, and DELETE /webApplicationRules/{rule_type}/{ruleId} endpoints to Cloud App Control Policies API Adds Download Sync and Upload Sync activities to the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Activities Report for OneDrive and SharePoint Adds support for .fcl, .aac, .greenshot, .heic, .heif, .img, .cap, and .sam file types in File Type Control and DLP policies
10 details in Everything
└──▷ BREAKING ON UPGRADE
! Existing MCAS partner integrations using token-based authentication remain supported but cannot be modified or recreated; users must convert to OAuth 2.0 to retain functionality
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-08-22
Aug 22, 2024
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds region-scoped Terraform onboarding, OS directory exclusion for VMs, and enhanced RBAC RBAC Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. for alerts.
Adds regional scoping when onboarding cloud accounts via Terraform templates to limit resource creation to specified regions Introduces a new set of data posture policies covering AWS RDS MySQL/PostgreSQL, S3, and Azure Blob Storage/Ransomware risk Adds region filtering on the Dashboard and Not In exclusion for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Engines and dictionaries in Data Inventory filters Updates RBAC permissions so users who can snooze alerts gain the ability to reset those alerts Expands Alert Details tab with Policy Category, Compliance Benchmark, and Compliance Category fields
+4 more
show less
Enables exclusion of OS directories and files during Azure and AWS VM data scanning to prevent unwanted scans Adds fixed and relative time operators for Date predicates and Included In operator for Boolean Resource Property queries in Investigations and Custom Policies Allows querying secondary and tertiary CSP CSP Content Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks. resources attached to primary resources using the Associated With predicate Renames Records and Matched Records terminology to Triggers
9 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-08-21
Aug 21, 2024
· release notes
ZPA adds Dynamic protocol support for Application Segments with Protocol Discovery analytics
Adds Dynamic protocol option to Application Segment configuration for protocol inspection
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-08-21
Aug 21, 2024
· release notes
Workflow Automation adds an Update Template button for published notification templates and allows deletion of resolved incidents via the UI
Adds an Update Template button to the Notification Template page for editing published templates, replacing the previous Save as Draft and Publish Template buttons. Adds the ability to delete a resolved incident by selecting the Delete action from the Actions drop-down menu on the Incident Details page.
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-08-21
Aug 21, 2024
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds regional Terraform onboarding, OS file exclusion for VMs, new query operators, and trigger terminology.
Adds region specification to Terraform templates for cloud account onboarding so DSPM resources are created only in target regions Adds OS directory and file exclusion capabilities when scanning AWS and Azure virtual machines to prevent scanning of unwanted data types Adds region filter support on the Dashboard, Not In (≠) exclude filter for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Engines/dictionaries on the Data Inventory page, Fixed/Relative time operators and Included In (⊆) operator for investigation/policy queries, and Associated With predicate for secondary resources
3 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-08-16
Aug 16, 2024
· release notes
Workplace Insights adds MoM/WoQ/QoQ trend indicators and a Days filter to the Averages section.
Adds MoM, WoW, and QoQ percentage change indicators to the Workplace Insights Averages widgets Adds a Days filter in Workplace Insights UI to isolate specific days of the week or dates within a time frame
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-16
Aug 16, 2024
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM format checks, OAuth2 OAuth2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. MCAS integration, NSS PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. field, file type control updates, and Cloud App Control API endpoints.
Adds %s{pcapid} field to NSS feed output formats for Web, Firewall, and DNS logs to provide packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file paths Enables DLP Exact Data Match (EDM) policies to enforce format checks for SSN, CCN, and CSIN in Administration > DLP Advanced Settings Adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. authentication option for Microsoft Cloud App Security (MCAS) partner integration via the Select Authentication Method setting in Administration > Partner Integrations Adds %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} fields to NSS Feed Output Format for web logs and corresponding filters/columns in Web Insights Logs Adds Cloud App Control Policy rules API endpoints under /webApplicationRules/ for creating, modifying, retrieving, and deleting rules
+2 more
show less
Enables traffic capture for IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control and Advanced Threat Protection policies when the action is set to Allow Increases Zscaler Sandbox file size limit to 50MB for Windows EXEs, Android APKs, and Archives
7 details in Everything
└──▷ BREAKING ON UPGRADE
! Existing MCAS partner integrations using token-based authentication cannot have configuration changes made or be created anew; converting to OAuth 2.0 removes the Token option.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-08-16
Aug 16, 2024
· release notes
ZDX adds macOS Bandwidth Test and Hi-Fi Cloud Path diagnostics sessions
Adds Bandwidth Test as a new Diagnostics session type for macOS devices via the ZDX Admin Portal (requires Client Connector v4.3.1 and ZDX Module v3.9) Adds Hi-Fi Cloud Path diagnostics session to provide detailed network connectivity and latency information
2 details in Everything
Authentication Service — Release Upgrade Summary (2024) — 2024-08-16
Aug 16, 2024
· release notes
ZIdentity Admin Portal gets a user activity dashboard and UI redesign; Login ID mapping moves to Basic tab.
Adds ZIdentity Dashboard tracking user activity with counts for users, service entitlement assignments, and authentication/user management event graphs Moves Login ID attribute mapping from Provisioning tab to Basic tab in Add Primary/Secondary Identity Provider window under Integrations > External Identities Redesigns ZIdentity UI with modern UX layout to reorganize menus for easier access to common configurations
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The option to map Login ID attribute as an optional configuration for JIT JIT A runtime compilation strategy where code is translated from an intermediate form to native machine instructions at execution time, giving tools the speed of compiled code without sacrificing dynamic flexibility. provisioning is removed; it must be mapped in Basic tab
Deception — Release Upgrade Summary (2024) — 2024-08-14
Aug 14, 2024
· release notes
Adds Force Delete for Cloud Deception settings and new CVE datasets/ThreatParse rules
Adds Force Delete option in Deceive > Cloud Deception > Azure > Settings to remove cloud resources when deployment scripts fail Adds Force Delete option in Deceive > Cloud Deception > AWS > Settings to remove cloud resources when deployment scripts fail Adds new Vulnerable Application Datasets for CData API Server, GitLab Server, ServiceNow, Check Point Quantum Gateway, Atlassian Confluence, Zyxel NAS326, Atlassian Jira, and GitHub Enterprise Adds new ThreatParse Rules to detect exploits for CData API Server CVE-2024-31848, GitLab Server CVE-2023-7028, PHP-CGI CVE-2024-4577, ServiceNow CVEs, Check Point Quantum Gateway CVE-2024-24919, and Atlassian Confluence CVE-2024-21683 Upgrades Decoy Connectors operating system to FreeBSD 14.1
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-12
Aug 12, 2024
· release notes
ZIA increases Zscaler Sandbox file size limit for EXE, APK, and Archives to 50MB
Zscaler Sandbox (Policy > Sandbox) now supports inspecting files up to 50MB for Windows EXEs, Android APKs, and Archives
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-08-12
Aug 12, 2024
· release notes
Adds debug mode for isolation profiles in ZPA to capture session diagnostics.
Admins can enable debug mode for isolation profiles to record and gather troubleshooting data for isolation sessions. Debug recordings generate diagnostics including basic session information, HTTP Archive format files, console logs, and network logs from the web browser.
2 details in Everything
Private Access (ZPA) — App Connector Release Summary (2024) — 2024-08-12
Aug 12, 2024
· release notes
App Connector 24.353.1 adds support for Zscaler-hosted OS patch repositories.
Provides updated App Connector RPM packages for Red Hat Enterprise Linux 7.x, 8.x, and 9.x
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-09
Aug 9, 2024
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /log fields, new API endpoints for Cloud App Control, and explicit proxy DNS flags.
Adds dnsoverproxy flag to configure NSS in explicit proxy mode for tunneling Zscaler cloud-bound connections. Adds %d{srv_dport}, %s{other_dlprulenames}, and %s{all_dlprulenames} fields to NSS Feed Output Format for Web Insights Logs. Adds new Web Insights Logs filters and columns Other DLP Rules and Server Destination Port in the ZIA Admin Portal. Adds 8 new endpoints for Cloud App Control Policies API under /webApplicationRules/. Enables Traffic Capture for IPS control and Advanced Threat Protection policies when action is set to Allow.
+1 more
show less
Increases Sandbox file size limit to 50MB for Windows EXEs, Android APKs, and Archives on zscalerone.net.
6 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-08-08
Aug 8, 2024
· release notes
Risk360 adds SSL/TLS Certificate Expiration factor to External Attack Surface category
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-08-06
Aug 6, 2024
· release notes
ZPA updates OWASP OWASP A nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. Predefined Controls default to CRS 3.3.5 on AppProtection Profiles pages
Enables use of OWASP_CRS/3.3.5 ruleset within AppProtection Profiles for ZPA service versions after Aug 6, 2024.
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-08-06
Aug 6, 2024
· release notes
POST /dlp/v1/incidents/search now accepts Incident Group and Engine fields
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-08-05
Aug 5, 2024
· release notes
ZPA introduced API Protection capabilities for inspecting designated application segment traffic, accessible via Support enablement.
Business Insights — Release Upgrade Summary (2024) — 2024-08-02
Aug 2, 2024
· release notes
Workplace Insights page adds Type/Geolocation filters, Top Cities widget, and split Map View tabs.
Replaces the Name filter with a Type and Geolocation filter on the Workplace Insights page Adds a Top Cities widget to display office visit frequency for top cities Splits the Map View widget into Geography and Remote User Density tabs
3 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-08-02
Aug 2, 2024
· release notes
Adds ZDX integration to automatically trigger ticketing system workflows from Digital Experience alerts.
Adds support for Workflow Automation Integration with Digital Experience (ZDX)
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-08-01
Aug 1, 2024
· release notes
ZIA enhancement for 3rd-party app governance displays Okta instance names
View the Okta application instance name next to the application name View the instance name on the App Panel Details tab
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-07-31
Jul 31, 2024
· release notes
ZPA PRA adds French, German, and Spanish keyboard support for RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. privileged consoles
Adds International Keyboard Support for Privileged Remote Access (PRA) on private.zscaler.com and zpatwo.net
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-07-30
Jul 30, 2024
· release notes
ZPA adds additional print options for web pages and documents within the Isolation environment.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-07-29
Jul 29, 2024
· release notes
ZPA adds collaborative privileged session control allowing hosts to invite, eject, and share mouse/keyboard control during live PRA sessions.
Hosts can now invite other users to attend and monitor a live Privileged Remote Access (PRA) session Invited participants receive full mouse and keyboard control of the live privileged session Hosts can regain control of the session at any time during the meeting Session hosts can invite additional participants or eject current participants while the session is active Hosts can terminate the privileged session for all connected participants via a disconnect action
5 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-07-26
Jul 26, 2024
· release notes
The release upgrades the Business Insights service from limited availability to General Availability, unlocking its SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. usage visibility, cost control models, and workplace utilization analytics for the entire customer base.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-26
Jul 26, 2024
· release notes
ZIA adds Block Non HTTP Traffic on HTTP/HTTPS Ports setting, Base64 DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /File Type support, ZSTD encoding inspection, and SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. Partner API management UI.
└──▷ HOW TO FIND IT
Restrict tunneling attacks by allowing only HTTP/HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic through proxy ports.
📍 Administration › Advanced Settings
Adds Administration > Advanced Settings > Block Non HTTP Traffic on HTTP/HTTPS Ports to restrict traffic exclusively to HTTP/HTTPS types. Enables File Type Control and DLP policies to decode and inspect Base64-encoded files for original type and sensitive data. Supports Zstandard (ZSTD) encoding (application/zstd) in proxy servers, allowing inspection of traffic from sites like Meta and Instagram without disabling browser-side compression. Allows ZIdentity admins to create and view SD-WAN partner API clients and roles via the ZIA Admin Portal.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The Partner Administrator role has been renamed to SD-WAN Partner API Client , and Partner Administrator Role has been renamed to SD-WAN Partner API Role .
Client Connector — Release Upgrade Summary (2024) — 2024-07-26
Jul 26, 2024
· release notes
Zscaler Client Connector Portal 4.2 adds installation type display, CSV uploads for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. bypass, ZDX provisioning, CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. toggle, and WebView2 cert ignore.
installation type added to enrolled devices to distinguish strict enforcement from general deploymentCSV file upload capability in the VPN Gateway Bypass section of App Profiles Direct ZDX License provisioning for existing ZPA-only customers without enabling device groups Perform CRL Check toggle added to Server Validated Client Certificate Posture profilesIgnore Client Cert errors for Webview2 option allows authentication with invalid/missing certificates via WebView2
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-24
Jul 24, 2024
· release notes
ZIA adds custom EUN templates and client connector support for Cloud App Control and URL Filtering policies
Adds Browser Notification Template field to Cloud App Control and URL Filtering policy rules to associate custom End User Notification (EUN) templates with block or caution actions. Adds End User Notification and Custom Message fields to granular Cloud App Control policy rule windows to enable Zscaler Client Connector-based notifications.
2 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-07-23
Jul 23, 2024
· release notes
Zscaler Workflow Automation adds location columns and filters for incidents, bulk labeling, and smart duplicate handling.
Adds Home Location and Work Location columns and filters to the Incidents page Adds Home Location and Work Location attributes to the Violation Details section of Incident details Enables bulk Label action on the Incidents page for multiple incidents at once
3 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-07-19
Jul 19, 2024
· release notes
Business Insights adds Attendance by Days per Week widget and missing data diagnostics to Workplace page
Adds Attendance by Days per Week widget to the Workplace Insights page for tracking office attendance patterns. Updates the existing Least Used section on the Workplace Insights page to display both least and most used offices. Enables viewing the reason for missing workplace data by hovering over the Error icon next to workplace names in Admin Portal pages.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-19
Jul 19, 2024
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. policy control, ZSTD decoding, Votiro integration, and API/device-group enhancements.
Adds IoT-Policy-Enable field to the Location Import CSV file for batch enforcement of IoT Policy Control Adds includeIOTGroups parameter to the /deviceGroups cloud service API endpoint Adds Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. Portal option under Dashboard and Policy in the Admin Portal for SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access Enables Base64-decoded file type detection in File Type Control policies Enables DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. inspection on Base64-encoded files
+5 more
show less
Adds Block Non HTTP Traffic on HTTP/HTTPS Ports toggle in Administration > Advanced Settings Enables Zstandard (ZSTD) decoding for web traffic inspection Integrates Votiro Secure File Gateway with Isolation profiles for file sanitization Supports custom client-side connector onboarding for Google Applications using Private Key JSON files Supports custom client-side connector onboarding for Google Cloud Platform (GCP) with Quarantine Bucket and Org ID
10 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-07-19
Jul 19, 2024
· release notes
ZDX adds Wi-Fi Dashboard and improves Data Explorer time granularity
Client Connector — Release Upgrade Summary (2024) — 2024-07-19
Jul 19, 2024
· release notes
Zscaler Client Connector Portal 4.2 adds install type display, CSV upload for VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. bypass, ZDX provisioning, and new posture/toggle options
Displays the installation type (strict enforcement vs general deployment) for enrolled devices in the portal Allows admins to upload CSV files in the VPN Gateway Bypass section of App Profiles Enables provisioning of ZDX License for existing ZPA-only customers without service interruption or device group enablement Adds the Perform CRL Check toggle to the Server Validated Client Certificate Posture profile Adds the Ignore Client Cert errors for Webview2 option to ignore client certificate errors during WebView2 authentication
5 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-07-19
Jul 19, 2024
· release notes
Risk360 adds support for NIST CSF NIST CSF The NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. 2.0 in the Admin Portal.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-18
Jul 18, 2024
· release notes
ZIA adds Outbound Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. with new policy rules, NSS log type, and analytics views
Adds the Administration > Email Tenants configuration area to specify which tenants use the Zscaler smart host Adds the Administration > Email Profiles configuration area to define domain and recipient profiles for outbound email policy Adds the Policy > Outbound Email Policy section for detecting data, allowing/blocking activities, and adding custom headers in outbound emails Adds the Email DLP log type for the Nanolog Streaming Service (NSS) to stream logs to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems Adds the Analytics > Email DLP Insights > Insights view for monitoring outbound email activity
+3 more
show less
Adds the Analytics > Email DLP Insights > Logs view for filtering and viewing Email DLP log details Adds the Analytics > Email DLP Report for reporting on Email DLP activities Adds the Dashboard > Email DLP dashboard for visual monitoring of email DLP metrics
8 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-07-18
Jul 18, 2024
· release notes
DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure SQL support, critical issues notifications, new data posture policies, and scan exclusions.
Adds Azure SQL Server as a supported datastore with automatic scanning, classification, and predefined policy checks Adds Critical Issues Notification visible after login to alert about cloud account access failures and links to the Issues tab Adds new Data Posture Policies for AWS and Azure including intelligence-driven ransomware risk policies and specific Azure SQL security rules Adds Folder Exclusion capability in scan settings to exclude specific Amazon S3 buckets or folders from data scans Adds Included In (⊆) operator support for policy and investigation queries allowing combinations of custom/preset values like Null
+1 more
show less
Adds Sensitive DLP Engine Filter on the Sensitive Data tab to filter files/tables by DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine sensitivity markers
6 details in Everything
Authentication Service — Release Upgrade Summary (2024) — 2024-07-18
Jul 18, 2024
· release notes
Authentication Service adds MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. exemptions for service enrollment and admin grace periods
Adds UI option to disable MFA for user service enrollment when SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. is enabled Adds UI option to allow users to skip 2FA for a short duration during admin portal login
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-17
Jul 17, 2024
· release notes
ZIA adds custom Browser EUN templates and Zscaler Client Connector-based notifications for Cloud App Control and Inline Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. .
Adds Browser Notification Template field to Cloud App Control and URL Filtering rules to show custom end user notifications when application access is blocked or cautioned Adds End User Notification and Custom Message fields to Cloud App Control policy rule windows to support Zscaler Client Connector-based EUNs Enables selection of Show/Hide EUN messages and custom text in Inline Web DLP policy rules, configurable under Administration > End User Notifications > Client Connector
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-16
Jul 16, 2024
· release notes
ZIA extends Cloud App Control and Inline Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies to show custom End User Notifications via Zscaler Client Connector.
Adds End User Notification and Custom Message fields in Cloud App Control Policy rule windows for granular action applications, enabling endpoint notifications via the Zscaler Client Connector. Enables Show or Hide options with custom EUN messages for Inline Web DLP policy rules, allowing end users on endpoints to see notifications when content triggers a DLP rule.
2 details in Everything
Data Security Posture Management (DSPM) — Release Upgrade Summary (2024) — 2024-07-16
Jul 16, 2024
· release notes
Zscaler DSPM DSPM Data security posture management, locating sensitive data and checking how it is protected and who can reach it. It helps teams prioritize risks around their data stores. adds Azure SQL support, S3 folder exclusion, investigation query operators, and sensitive DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine filter
Adds Azure SQL Server as a supported datastore for data scanning and posture classification. Adds an Issues tab visible post-login to notify about cloud account access failures during onboarding or configuration changes. Introduces new Data Posture Policies for AWS and Azure, including intelligence-driven policies for ransomware risk based on active vulnerability campaigns. Enhances the Alert Details tab with links to the Data Inventory page, alert status reason details, and a vulnerability graph view. Adds folder exclusion capabilities in scan settings to exclude specific Amazon S3 buckets or folders from data scans.
+3 more
show less
Adds support for the Included In (⊆) operator in investigation queries and custom policies to combine custom values with preset values like Null and Doesn't Exist. Displays scan statistics on the DSPM dashboard, showing discovered and scanned resources by category. Adds a Sensitive DLP Engine filter on the Sensitive Data tab to filter files or tables by specific DLP engines.
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-15
Jul 15, 2024
· release notes
ZIA allows custom end user notification templates for Cloud App Control and URL filtering rules
Business Insights — Release Upgrade Summary (2024) — 2024-07-12
Jul 12, 2024
· release notes
Business Insights adds Active/Inactive user tabs, CSV export, and downloadable Applications and Workplaces reports.
Adds Active Users and Inactive Users tabs to the Engagement Index & Users tab on the Application Details page Adds the ability to filter table data for a specific time frame on the Engagement Index & Users tab Adds the Export option to download table data into a CSV file on the Engagement Index & Users tab Adds access and download capability for Applications Report from the Reports page in the Business Insights Admin Portal Adds access and download capability for Workplaces Report from the Reports page in the Business Insights Admin Portal
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-12
Jul 12, 2024
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. policy control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Risky Behaviors category, URL filtering AND logic, Votiro file sanitization, and new API endpoints.
Adds IoT-Policy-Enable field to Location Import CSV and UI to apply URL/Cloud App policies to discovered IoT devices Adds IPS threat category Risky Behaviors with allow/bypass actions in Firewall Logs Adds urlCategories2 parameter to UrlFilteringRule API model for AND logic on URL categories Adds /urlCategories/review/domains API endpoint (POST/PUT) to find matching entries in custom URL categories Integrates Votiro Secure File Gateway with ZIA Isolation profiles for file disarm and reconstruction
+1 more
show less
Adds new field proximityEnabledForCustomDictionary to /dlpDictionaries API endpoints for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary proximity length
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-10
Jul 10, 2024
· release notes
ZIA adds Outbound Email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. enforcement, Encrypt action for removable storage, and macOS Network Share blocking
Outbound Email Data Loss Prevention (DLP) allows policy enforcement on email content sent to external domains using the same tools as Inline Web DLP, Endpoint DLP, and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP Endpoint DLP policy rules gain a new Protect action that encrypts files copied to removable storage devices for safe internal sharing only Endpoint DLP supports the Block action for the Network Share channel on macOS A new log type, Email DLP, is available for Nanolog Streaming Service (NSS) and Cloud NSS feeds to stream logs to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. systems New Analytics pages are added for monitoring: Email DLP Insights, Email DLP Insights Logs, Email DLP Report, and Dashboard > Email DLP
+3 more
show less
Support for Shift JIS Encoding is added for extracting Japanese text from files in Endpoint DLP Customized end user notification (EUN) and confirmation messages are available for Endpoint DLP New predefined DLP dictionaries are supported, including Tax Identification Numbers for Finland, Greece, Ireland, Peru, Poland, Spain, US; VAT Number (Ireland); and others
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-07-09
Jul 9, 2024
· release notes
ZPA enhances User Risk Score resilience to maintain client connections during configuration changes.
Clients remain connected to ZPA Private Service Edges when the user risk feature is enabled or disabled at the admin level.
1 detail in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2024) — 2024-07-09
Jul 9, 2024
· release notes
ZPA PSE 24.325.1 allows clients to maintain connectivity during user risk feature toggles.
Clients remain connected to ZPA Private Service Edges when the user risk feature is enabled or disabled at the admin level
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-07-09
Jul 9, 2024
· release notes
Zscaler Workflow Automation adds async email notifications, download restarts, new UI columns/actions, and concurrency limits.
Adds Async Activity Email Notifications to alert on Complete, Partial Success, and Failed statuses for downloads and bulk actions Adds a Notes column to the Bulk Actions page in the Admin Portal Adds an Assign to Me action to the Incidents page Actions menu Enables Resume and Try Again options to restart Partial Success or Failed incident file downloads and bulk actions (max 3 restarts) Implements a concurrency limit of three simultaneous async activities for downloads and bulk actions
+1 more
show less
Updates incident export CSV timestamps to reflect the user's local browser time zone
6 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-07-09
Jul 9, 2024
· release notes
Zscaler Client Connector 1.5.1.32 for Linux improves connection stability and authentication handling.
Business Insights — Release Upgrade Summary (2024) — 2024-07-05
Jul 5, 2024
· release notes
Business Insights Admin Portal now displays application sanction status.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-05
Jul 5, 2024
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Policy Control, IoT device group support in Device Groups API, and two-step admin portal login.
└──▷ HOW TO FIND IT
Bulk-enable IoT policy enforcement for multiple existing locations via CSV import.
📍 IoT-Policy-Enable
Enforce IoT Policy Control option added to Gateway Options in Add/Add Sub-Location windowsIoT-Policy-Enable field added to the Locations Import CSV for bulk location configurationIoT group added to Device Groups criterion in URL Filtering and Cloud App Control policiesAllow Unauthenticated Traffic for IoT Classifications predefined rule available for policy evaluationincludeIOTGroups parameter added to /deviceGroups API endpoint
+1 more
show less
ZIA Admin Portal sign-in changed to two-step ZIdentity or password flow based on account settings
6 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-07-05
Jul 5, 2024
· release notes
ZDX Copilot adds dynamic recommendations, Web probe metrics, device health analytics, and Wi-Fi/call quality diagnostics.
Adds dynamic recommendations based on ZDX Copilot chat session history Adds support for Web probe metrics in ZDX Copilot Adds support and diagnostics for Wi-Fi issues in ZDX Copilot Adds support and diagnostics for call quality issues in ZDX Copilot
4 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-07-05
Jul 5, 2024
· release notes
Zscaler Client Connector 4.3 adds CLI access, ZIdentity integration, and macOS localization.
Provides CLI Access on Zscaler Client Connector and allows admins to interact with Zscaler Client Connector via CLI Supports ZIdentity integration for the following features: Strict Enforcement mode, System Proxy fallback when direct enrollment fails, Endpoint Data Loss Prevention (DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. ), and support for device groups and service entitlement in ZIdentity. Adds localization support to change the language of the app user interface based on the system language. Zscaler Client Connector version 4.3 and later for macOS supports changing the English language to French and vice versa. Allows administrators to bypass the IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. traffic during Zscaler Client Connector authentication.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Deprecates the legacy PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parser option and replaces it with V8 JavaScript engine-based PAC parser. For Zscaler Client Connector versions 4.3 and later for macOS, the legacy PAC parser option is unavailable.
Risk360 — Release Upgrade Summary (2024) — 2024-07-05
Jul 5, 2024
· release notes
Zscaler Risk360 enables users to configure alert rules for automated email and webhook notifications.
Allows configuration of criteria for alert notifications.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-03
Jul 3, 2024
· release notes
ZIA allows custom End User Notification messages for inline Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy rules triggered on endpoints.
Adds Show or Hide EUN message selection in DLP policy rule configuration to control inline web DLP end-user notifications Adds ability to specify custom EUN text content per DLP rule under Administration > End User Notifications > Client Connector
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-07-02
Jul 2, 2024
· release notes
ZIA inline web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. now inspects sensitive information contained in file names
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-07-01
Jul 1, 2024
· release notes
ZPA adds new App Connector and Private Service Edge images for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 on AWS and Azure.
Adds support for new Red Hat Enterprise Linux 9 App Connector images for AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. and Microsoft Azure
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-07-01
Jul 1, 2024
· release notes
Adds custom Azure DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. storage endpoints, incident export PDF download, bulk actions page, and email notifications for downloads/exports.
Adds a Custom Storage Endpoint URL field to the Zscaler DLP Azure Integration page in Workflow Automation Admin Portal to use private endpoints Adds an Export icon on the Incident Analytics dashboard to export displayed analytics to a PDF file Enhances the Time Range Filter on Incidents and Incident Analytics pages to allow selecting the current date in Custom Date Range mode Sends email notifications when incident file exports are completed and ready for download from the Downloads page Sends workflow automation admin portal notifications when incidents CSV export is completed
+1 more
show less
Adds a new Bulk Actions page under My Activity > Bulk Actions to monitor status of bulk actions on Incidents
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The Event Grid Topic Resource Id field is renamed to Event Grid System Topic Resource Id in the Zscaler DLP Azure Integration configuration
Risk360 — Release Upgrade Summary (2024) — 2024-07-01
Jul 1, 2024
· release notes
Adds four new UEBA factors for Data Loss detection in Zscaler Risk360.
Adds Code Repository Made Public factor to UEBA Data Loss category Adds Code Repository Shared Externally factor to UEBA Data Loss category Adds Bulk Files Delete Operation factor to UEBA Data Loss category Adds Data Uploads to High-Risk Countries factor to UEBA Data Loss category
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-28
Jun 28, 2024
· release notes
ZIA adds URL category pairing via API and UI, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. policy control, Risky Behaviors IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. category, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. filename inspection, and new file type support.
Adds urlCategories2 parameter to the UrlFilteringRule API model for AND logic in URL filtering rules Adds /urlCategories/review/domains endpoint to review matching entries for URLs in existing custom URL categories Adds IoT-Policy-Enable field to the Location Import CSV to enforce IoT policy control across multiple locations Adds new Risky Behaviors predefined IPS threat category for targeted IPS rule conditions Adds Threat Severity and Threat Score filters/columns to Firewall Insights Logs and %d{threat_score}/%s{threat_severity} fields to NSS feeds
+1 more
show less
Adds file name inspection support in inline web DLP policies to detect sensitive information in filenames
6 details in Everything
Authentication Service — Release Upgrade Summary (2024) — 2024-06-28
Jun 28, 2024
· release notes
ZIdentity adds device groups, service entitlements, machine tunnels, and token auth for Zscaler Client Connector.
Adds Device groups and service entitlement support for Zscaler Client Connector in ZIdentity Adds Machine tunnel support for Zscaler Client Connector in ZIdentity Adds Device token-based authentication for Zscaler Client Connector as an identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. (IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. ) in ZIdentity Adds Zscaler Client Connector dynamic service enrollments support in ZIdentity
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-27
Jun 27, 2024
· release notes
ZPA adds Application Deep Linking for Isolation profiles to invoke client apps from isolated sessions.
Enables granular control of invoked client applications per isolation profile with an allowlist and associated URL scheme configuration
1 detail in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-06-27
Jun 27, 2024
· release notes
Zscaler Client Connector 4.5 adds ZIdentity integration, captive portal PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. auto-start, and localization.
Adds support to use a PROXY return statement in the PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file for Zscaler Internet Access (ZIA) Disaster Recovery Configuration Adds support to automatically start packet captures packet captures A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. when a captive portal is detected Supports using the Enable Anti-tampering setting from the app profile regardless of installation method Adds localization support to change the app user interface language based on the system language
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Firefox integration no longer supports Mozilla Developer Preview or Firefox downloaded from the Microsoft Store
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-26
Jun 26, 2024
· release notes
Zscaler Private Access adds Application Deep Linking for Isolation profiles.
Enables Application Deep Linking in isolation profiles to invoke end-user client apps via URL schemes from isolated web pages
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-24
Jun 24, 2024
· release notes
ZPA adds support for Red Hat Enterprise Linux 9 App Connectors and Private Service Edge images in Docker and KVM KVM A Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed. formats
Adds Red Hat Enterprise Linux 9 App Connector images available for Docker deployment Adds ZPA Private Service Edge images available for Docker deployment Adds Red Hat Enterprise Linux 9 App Connector images in KVM qcow2 format for Equinix Network Edge Adds ZPA Private Service Edge images in KVM qcow2 format for Equinix Network Edge
4 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-06-21
Jun 21, 2024
· release notes
Workplace Insights pages add PDF export and Save and Add New office configuration option.
Adds Export as PDF option to the Workplace Insights and Offices and Locations pages for documentable reporting Adds Save and Add New option in the Add Office drawer to rapidly configure multiple offices without losing current settings Adds View icon for read-only admins on the Configured Offices page
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-21
Jun 21, 2024
· release notes
ZIA introduces inline web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file name inspection and renames AppTotal to 3rd-Party App Governance
└──▷ BREAKING ON UPGRADE
! The AppTotal product name is replaced by 3rd-Party App Governance in UI and documentation.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-19
Jun 19, 2024
· release notes
ZPA introduces a new insights capability for risk analysis aligned with the MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. framework.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-14
Jun 14, 2024
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. policy enforcement, DC exclusion by forwarding method, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. /file types, and API endpoints
Adds IoT-Policy-Enable field to the Import CSV for Locations to enforce IoT Policy Control across multiple locations. Adds Risky Behaviors predefined IPS threat category to exclude risky signatures from blocking while allowing logging. Adds /urlCategories/review/domains POST/PUT API endpoint to find matching entries for URLs in existing custom URL categories. Adds urlCategories2 parameter to the UrlFilteringRule API model to support AND logic between URL categories in filtering rules. Adds includeIOTGroups parameter to the /deviceGroups cloud service API endpoint.
+4 more
show less
Adds new Traffic Forwarding Method page in Administration > Resources to disable tunnels at specific Zscaler data centers based on forwarding method. Adds %d{threat_score} and %s{threat_severity} fields for firewall logs in NSS Feeds. Adds Blocked - Tenant Restricted filter option to Web Insights Logs. Expands DLP and File Type Control support to include Microsoft Access (.accdb), CATIA, Certificate (.pfx), Greenshot, KeePass (.kdbx), OneNote, PGP, and XZ Utils file types.
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-12
Jun 12, 2024
· release notes
ZIA adds Device Trust Attribute option and Blocked - Tenant Restricted log filter
Adds Is Device Managed Attribute True option to identify managed devices in Zscaler Identity Proxy for Authentication Service-enabled tenants Replaces Proxied via Zscaler and Proxied via Zscaler with IdP Attribute options with Device Trust Attribute Matches the Configured Value for tenants without Authentication Service Adds Blocked - Tenant Restricted filter option to Web Insights Logs for filtering transactions blocked by Tenancy Restriction policies
3 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-06-12
Jun 12, 2024
· release notes
Adds My Activity > Downloads page to download exported incident CSV files.
Authentication Service — Release Upgrade Summary (2024) — 2024-06-12
Jun 12, 2024
· release notes
ZIdentity adds Restricted Full admin permissions, predefined dynamic groups, and Zscaler Identity Proxy session attributes.
Adds Restricted Full permission option when assigning administrative roles in the ZIdentity Admin Portal to enforce permission checks before entitlement changes. Adds five new system-defined dynamic groups: Dynamic Group Registered Domains, Dynamic Group Guest Domains, Dynamic Group Administrators, Zscaler Global Administrators, and Zscaler Emergency Access. Adds Is Device Managed session attribute passed to Zscaler Identity Proxy for Cloud Apps to determine device management status for access policies.
3 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-06-11
Jun 11, 2024
· release notes
Zscaler Risk360 adds Tenable Vulnerability Management integration to quantify external attack surface attack surface The exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. risk.
Integrates with the Tenable Vulnerability Management solution by calling its API to pull vulnerability data into Risk360's External Attack Surface category. Quantifies risk using CVSS CVSS Common Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score, VPR score, exploit code maturity, and threat recency from Tenable.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-10
Jun 10, 2024
· release notes
Privileged Session Playback allows transcoding recordings to streamable format and downloading via admin role.
Adds privileged session recording transcoding from raw to streamable format for streaming playback Enables administrator roles with full access to download privileged session recordings from the Privileged Sessions page
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-06-10
Jun 10, 2024
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. 1.3.0.14 adds USEEMBEDDEDBROWSER installer parameter.
Cloud & Branch Connector — Zscaler Client Connector for VDI Release Summary (2024) — 2024-06-10
Jun 10, 2024
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. 1.3.0.14 adds USEEMBEDDEDBROWSER installer parameter for embedded browser support
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-07
Jun 7, 2024
· release notes
ZIA adds Data Center Exclusion via Traffic Forwarding page and increases Sandbox file size limit for select types.
Adds a new Traffic Forwarding Method page in Administration > Resources to add, edit, and delete Data Center exclusions based on traffic forwarding method Adds DC Exclusion category and Traffic Forwarding Method subcategory to Audit Logs for viewing DC exclusion events Sets Org excluded from DC value in the Event Reason column of Tunnel Insights Logs when a tunnel is brought down due to DC exclusion Sets ORG_EXCLUDED value in the Nanolog Streaming Service (NSS) field %s{eventreason} when a tunnel is brought down due to DC exclusion Increases Zscaler Sandbox file size limit to 50MB for Windows EXEs, Android APKs, and Archives
5 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-06-07
Jun 7, 2024
· release notes
ZDX adds AI-powered conversational assistant for admins in the Admin Portal
Client Connector — Client Connector App Release Summary (2024) — 2024-06-06
Jun 6, 2024
· release notes
Zscaler Client Connector 3.7 for Linux adds DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. 1.2, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. in TWLP/Z-Tunnel 1.0, and split VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. interface binding.
Supports the DTLS 1.2 protocol for Zscaler Client Connector Adds native IPv6 support for Tunnel with Local Proxy (TWLP), Enforce Proxy, and None modes for the ZIA service using carrier-provided NAT64 support Supports Split VPN (exclude routes) by binding to a specific interface
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-05
Jun 5, 2024
· release notes
New Blocked - Tenant Restricted filter added to Web Insights Logs
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-05
Jun 5, 2024
· release notes
New VMware images for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 9 App Connector and ZPA Private Service Edge expand platform support.
Deception — Release Upgrade Summary (2024) — 2024-06-05
Jun 5, 2024
· release notes
Zscaler Deception adds dedicated Chrome lure profiles and proxy awareness for Windows landmine agents
Adds Dedicated User Profiles for deploying Chrome browser lures instead of using the default profile Adds proxy awareness to Standalone Landmine Agents for Windows to automatically detect system proxy settings
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-04
Jun 4, 2024
· release notes
ZPA adds support for Red Hat Enterprise Linux 9 for App Connector and ZPA Private Service Edge components.
Private Access (ZPA) — App Connector Release Summary (2024) — 2024-06-04
Jun 4, 2024
· release notes
App Connector 24.208.1 adds Protocol Discovery support for AppProtection segments and fixes OpenSSL vulnerability.
Adds support for Protocol Discovery of AppProtection-enabled application segments Includes updated App Connector RPM packages for Red Hat Enterprise Linux 7.x, 8x, and 9.x
2 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-06-04
Jun 4, 2024
· release notes
Client Connector adds ZDX password requirement and captive portal notification across Android/ChromeOS.
Adds the ability to require a password to disable Digital Experience (ZDX) Supports user privacy configurations for ZDX, configurable on the Zscaler Client Connector Portal Notifies users when a captive portal is detected and allows them to open their default browser to show the captive portal
3 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-06-04
Jun 4, 2024
· release notes
Risk360 adds asset-level risk scoring view in the Admin Portal.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-06-03
Jun 3, 2024
· release notes
ZIA triggers 3rd-party app governance policies on app reinstall via new App Status filter
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-06-03
Jun 3, 2024
· release notes
ZPA improves Public Service Edge proximity override logic to evaluate all PSE groups before redirecting users.
Business Insights — Release Upgrade Summary (2024) — 2024-05-31
May 31, 2024
· release notes
Business Insights adds manual office creation and revamps workplace insights UI with new Offices and Locations views
Adds Add Manually option on the Configured Offices page to create office configurations without requiring a CSV file upload Introduces a new Offices and Locations page in the Workplace section of the Business Insights Admin Portal for viewing office sites via list, maps, or charts Renames the existing Configure or Edit Offices option to Add with Template
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The Cities, Departments, Offices, and Work Mode pages are no longer available; metrics are moved to the new revamp pages
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-31
May 31, 2024
· release notes
Adds permission group validations for custom roles in the ZPA Admin Portal
Adds validation of missing permissions for custom roles on the Roles page and when configuring or editing a custom role
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-30
May 30, 2024
· release notes
ZPA Admin Portal adds validation for missing permissions when creating or editing custom roles.
Adds permission group validations for custom roles in the Roles page of the ZPA Admin Portal and when configuring groups
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-29
May 29, 2024
· release notes
Updates to PSE proximity override logic improve user routing accuracy by evaluating all relevant PSE groups.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-05-28
May 28, 2024
· release notes
Adds ZPA Microtunnels filter to Web/Firewall Insights Logs in ZIA
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-05-24
May 24, 2024
· release notes
Adds ZPA Microtunnels (M-Tunnels) filter option to Web Insights Logs and Firewall Insights Logs for ZIA Inspected ZPA Apps traffic.
Workflow Automation — Release Upgrade Summary (2024) — 2024-05-24
May 24, 2024
· release notes
Workflow Automation adds an All widget to the Incidents page showing total incident count regardless of status.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-05-24
May 24, 2024
· release notes
Adds ZDX Snapshot sharing for alerts and diagnostics, new ZPA Public Service Edge incident type, and Deep Tracing renamed to Diagnostics
Adds ZDX Snapshot feature providing a URL for view-only access to specific Alert or Diagnostics details pages for users without admin login Adds ZPA Public Service Edge as a new incident type on the Incidents Dashboard providing key metrics on ZPA traffic at the data center Renames Deep Tracing to Diagnostics in the navigation menu and page labels within the ZDX Admin Portal
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-05-24
May 24, 2024
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. adds HIDEAPPONUILAUNCH installer parameter to minimize window on launch.
Private Access (ZPA) — App Connector Release Summary (2024) — 2024-05-24
May 24, 2024
· release notes
App Connector 24.208.1 adds Protocol Discovery for AppProtection-enabled segments.
Risk360 — Release Upgrade Summary (2024) — 2024-05-24
May 24, 2024
· release notes
New CSV export for organization risk factors via the Factors page UI
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-05-17
May 17, 2024
· release notes
ZDX adds Data Explorer Views for custom metric organization and CSV device inventory downloads
Data Explorer now supports creating and organizing custom views of applications and metrics. Device Inventory allows downloading current device and user data in CSV format.
2 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-05-17
May 17, 2024
· release notes
Client Connector 1.5.1 adds protection against DHCP 121 route injection and VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. decloaking.
Adds protection against DHCP 121 route injection or VPN decloaking (CVE-2024-3661) Non-private IP routes installed via DHCP Option 121 are now redirected to the Zscaler Client Connector virtual adapter
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-16
May 16, 2024
· release notes
ZPA adds IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. filtering to User Risk Scores page, a new Audit Log resource type, and App Connector restart diagnostics.
Adds IdP Name filter option on the User Risk Scores page of the ZPA Admin Portal Adds a new User Risk Scores resource type in the ZPA Admin Portal Audit Logs Adds App Connector Restart Reason field to the App Connector Status Diagnostics page
3 details in Everything
Authentication Service — Release Upgrade Summary (2024) — 2024-05-16
May 16, 2024
· release notes
ZIdentity adds session attributes for ZPA policy enforcement, custom branding, and department attribute management.
Adds session attributes to ZIdentity, allowing admins to record and expose user session context for Zscaler Private Access (ZPA) policies Enables customizing the login logo and sender email address sent by the Zscaler service in ZIdentity Adds a system-defined Department user attribute viewable and editable in the ZIdentity Admin Portal
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-13
May 13, 2024
· release notes
ZPA adds ZIA security service inspection (TLS, ATP, URL filtering) for private app segments with new diagnostics filters.
Adds ZIA Inspection client type filter in the ZPA User Status Diagnostics page Adds ZIA Inspection enablement status and transaction type filters in the ZPA User Activity Diagnostics page Adds session status codes for ZIA inspection to diagnose private application traffic
3 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-05-13
May 13, 2024
· release notes
Zscaler Client Connector for macOS adds automatic blocking of DHCP 121 routes or VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. decloaking to address CVE-2024-3661.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-05-10
May 10, 2024
· release notes
ZIA adds Basic Auth exemptions, GitHub keyword instances, Custom SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Connectors, Shadow IT tag filtering, new file types, and API attributes
Adds Basic Authentication Exemption capability in Advanced Settings to exempt URL categories, cloud app categories, or specific cloud apps from Basic Authentication (max 25K URLs, 64 categories) Adds Keyword instance identifier to GitHub Instance type for Cloud Application Instances Adds Custom SaaS Connector onboarding using Client ID, Client Secret, and Tenant ID for Microsoft SaaS applications (Azure Blob Storage, Exchange, OneDrive, SharePoint, Teams) and MIP accounts Adds Filter and View Tags functionality in the Shadow IT Report Adds support for new file types in File Type Control & DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies: ICS ICS Industrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. , HBS, VDA, ACIS, PS2, PS3, PRT, Parasolid (.x_b, .x_t), IGS (.igs, .iges), draw.io (.drawio), TMP, MUI (Other Documents); Export (.exp), TLB, ASHX (Source Code); .cat, .onetoc2 (Other Microsoft); .vmdk, .sdb (Database)
+1 more
show less
Adds dictionaryCloningEnabled and customPhraseSupported attributes to the /dlpDictionaries cloud service API endpoints
6 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-05-10
May 10, 2024
· release notes
ZDX release adds ISP performance monitoring and Android device diagnostics.
Client Connector — Release Upgrade Summary (2024) — 2024-05-10
May 10, 2024
· release notes
Portal 4.1.1 adds ZIdentity authentication for admin access.
Allows admins to authenticate to the Zscaler Client Connector Portal via ZIdentity.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-08
May 8, 2024
· release notes
ZPA adds App Connector Restart Reason field to App Connector Status Diagnostics
Risk360 — Release Upgrade Summary (2024) — 2024-05-07
May 7, 2024
· release notes
Risk360 adds ZSLogin SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration, enhanced Posture, Segmentation, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cards with new widgets.
Adds ZIdentity /ZSLogin integration for single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to Risk360 admin portals via the Administrator Management page SSO link. Adds Access Policies without Posture Profile trend graph and sample list widget on Insights > Posture Profile. Adds Application Segments with Open Ports trend graph and sample table widget on Insights > Segmentation. Adds Top 5 Uninspected User Traffic by URL Hosts bar chart widget on Insights > SSL Inspection.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-05-03
May 3, 2024
· release notes
ZIA adds Keyword instance ID for GitHub instances, vzen_custom.conf param to prevent Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. bypass on ports 8080/8443, and API fields for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary settings.
Adds Keyword instance identifier support for GitHub cloud application instances in addition to URL. Adds spnego_krb_noport_bypass=1 parameter to vzen_custom.conf to prevent Kerberos authentication bypass on ports 8080 and 8443. Updates /dlpDictionaries API endpoints to include dictionaryCloningEnabled and customPhraseSupported attributes in the DlpDictionaryDom model.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-03
May 3, 2024
· release notes
ZPA PRA portal adds section-specific search and pagination; Bandwidth Utilization thresholds update.
Adds a dedicated search bar for Microtenants, Shared Sessions, and My Consoles sections in the Privileged Remote Access (PRA) Portal Enables filtering and pagination for displayed privileged consoles in the PRA portal Updates Bandwidth Utilization Exceeded Limit event to support ZPA Private Service Edges and lowers threshold from 350 Mbps to 250 Mbps
3 details in Everything
Client Connector — Release Upgrade Summary (2024) — 2024-05-03
May 3, 2024
· release notes
Zscaler Client Connector Portal 4.1.1 adds ZIdentity authentication for admins.
Client Connector — Client Connector App Release Summary (2024) — 2024-05-03
May 3, 2024
· release notes
Client Connector 3.7 adds native IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, posture-based risk profiles for ZIA, and segmented HTTP requests in Z-Tunnel 1.0.
└──▷ HOW TO FIND IT
Enable Tunnel SDK 3.7 to use native IPv6 and segmented HTTP requests features.
📍 Contact Zscaler Support to enable Tunnel SDK 3.7
└──▷ BREAKING ON UPGRADE
! All users running iOS 17.4.X must upgrade to iOS version 17.5.X to start VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. on demand.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-05-02
May 2, 2024
· release notes
Privileged Consoles limit raised to 35,000 per account and new search/filter in PRA Portal
Increases the maximum number of privileged consoles available in an account from the previous limit to 35,000 (up to 6,000 per Microtenant). Adds a dedicated search bar and pagination controls to the Privileged Remote Access (PRA) Portal sections: Microtenants, Shared Sessions, and My Consoles.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-04-30
Apr 30, 2024
· release notes
ZPA adds ZPE bandwidth limit event support and relabels disconnect/CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. starvation events in Admin Portal
Adds support for configuring Bandwidth Utilization Exceeded Limit event specifically for ZPA Private Service Edges with a threshold decreased to 250 Mbps Updates notification labels for SYSTEM_CONTROL_DISCONNECTED and SYSTEM_RESOURCE_CPU_STARVATION events to Control Connection Disconnected and CPU Starvation in the ZPA Admin Portal
2 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-04-29
Apr 29, 2024
· release notes
Zscaler Workflow Automation adds auto-assignment, delete permissions, incident labeling API, self-assign action, and email DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support.
Adds Auto Assign Incidents toggle in the Admin Assignment UI to automatically assign new incidents to admins Adds Delete permission under the Incidents category for admin roles in the Add Role page, enabling incident deletion via UI Adds POST /dlp/v1/incidents/{dlpIncidentId}/labels API endpoint to assign labels to DLP incidents Adds Assign to Me action in the Actions menu on the Incident Details page for self-assignment of incidents Enables display and remediation of Email Data Loss Prevention (DLP) incidents within Workflow Automation
5 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-04-26
Apr 26, 2024
· release notes
Adds Configured Offices page to Business Insights Admin Portal for office-specific metrics
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-26
Apr 26, 2024
· release notes
ZIA adds Basic Authentication exemption for URLs/categories/apps and extends IBM SmartCloud to Tenant Profiles.
Adds ability to exempt specific URL categories, cloud app categories, or cloud apps from Basic Authentication in Advanced Settings
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-19
Apr 19, 2024
· release notes
ZIA adds Basic Auth exemptions, new File Type DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support, and spnego_krb_noport_bypass param for VSE kerberos.
Adds Basic Authentication Exemption capability to exempt specific URL categories, cloud app categories, or cloud apps from basic auth enforcement in Advanced Settings Adds support for new file types in File Type Control and DLP policies, including ICS ICS Industrial Control Systems — hardware and software that monitor and control physical processes like power grids, pipelines, and manufacturing lines, making them a target for cyber tools focused on operational technology environments. , HBS (.hbs), VDA (.vda), ACIS (.sat), PS2 (.ps2), PS3 (.ps3), PRT (.prt), Parasolid (.x_b, .x_t), IGS (.igs, .iges), draw.io (.drawio), TMP (.tmp), MUI (.mui), Export (.exp), TLB (.tlb), ASHX (.ashx), Microsoft Catalog (.cat), OneNote (.onetoc2), Virtual Hard Disk (.vmdk), and SDB (.sdb) Adds spnego_krb_noport_bypass=1 parameter to the vzen_custom.conf file to prevent Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. authentication bypass for ports 8080 and 8443 on Virtual Service Edges Updates the /dlpDictionaries API endpoint to include dictionaryCloningEnabled and customPhraseSupported attributes in the DlpDictionaryDom model
4 details in Everything
Deception — Release Upgrade Summary (2024) — 2024-04-17
Apr 17, 2024
· release notes
Zscaler Deception adds Okta AI containment integration and removes phone/SMS SMS Short Message Service, the protocol built into cellular networks for sending text messages between phones; cyber tools use it for alerting, two-factor authentication delivery, or phishing simulation over mobile channels. notification support.
Adds Integration for Identity Threat Protection with Okta AI using the Shared Signals Framework (SSF) Removes Phone and SMS notification options from Orchestration Rules, Event Templates, and User Profiles
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The Phone and SMS notification options are removed from the Rule Details window in Orchestrate > Rules.! The phone field is removed from the User Details window in Settings > Users.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-04-16
Apr 16, 2024
· release notes
New filters added to App Connector and ZPA Private Service Edge management pages.
Adds Current Software Version , ID, Manager Version , and Upgrade Status filter fields to the App Connectors page Adds Current Software Version , ID, Manager Version , and Upgrade Status filter fields to the ZPA Private Service Edges page Displays total count of items and current page count at the bottom of the App Connectors and ZPA Private Service Edges tables
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-04-15
Apr 15, 2024
· release notes
ZPA adds debug mode for isolation profiles to capture session diagnostics.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-12
Apr 12, 2024
· release notes
ZIA adds Debug Mode for Isolation, HTTP Range Header removal via Advanced Settings, and a paginated Firewall Filtering policy with advanced search
Adds Debug Mode for isolation profiles on zscalerone.net, zscalertwo.net, and zscalerthree.net to record and export diagnostics including HTTP Archive files, console logs, and network logs Enhances Firewall Filtering Policy page (under Policy > Firewall Control > Firewall Filtering Policy) with pagination and category-specific search fields for tenants upgraded to 4,000 rules
2 details in Everything
Client Connector — Release Upgrade Summary (2024) — 2024-04-12
Apr 12, 2024
· release notes
Zscaler Client Connector 4.1 adds WebView2 direct internet option, per-OS Custom IP-Based App Bypass, and macOS serial number visibility.
Adds the WebView2 option to not follow the system proxy and connect directly to the internet Supports Custom IP-Based App Bypass configuration enabled per OS platform Allows Zscaler Client Connector to block all inbound traffic for various network types with an option to exclude ports Adds the ability to view macOS device serial numbers in the Registration Details section of the Zscaler Client Connector Portal Includes Authentication Service integration for Strict Enforcement mode, Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , machine tunnel authentication, and other features
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-08
Apr 8, 2024
· release notes
ZIA adds manual risk score override, CSV export, and status-based recalculation for app findings in 3rd-Party App Governance
Adds the ability to manually change the risk score for an app in the App Inventory or App Panel header, with support reverting to the default. Enables exporting app risk scores from the App Inventory to a CSV file. Enhances 3rd-Party App Governance policy notifications to include automated actions taken (classification, workflow) and indicates the matching policy in the title.
3 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-04-05
Apr 5, 2024
· release notes
The Business Insights service update on April 05, 2024 introduces a new integration with the ZIdentity service. This allows users with ZIdentity to access the Administrator and Administrator Management pages via single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. ).
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-04-05
Apr 5, 2024
· release notes
ZIA adds debug mode for isolation sessions, Webex UCaaS one-click config, proximity length for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dicts, URL cat range header removal, and IBM SmartCloud tenant profile supp
debug toggle for isolation profiles enables recording of troubleshooting data (HTTP Archive, console logs, network logs) for any isolation session.Adds URL Categories field under the Remove Range Headers section in Advanced Settings (Administration > Advanced Settings) to exclude specific URLs from range header stripping. Extends UCaaS one-click configuration support to the Webex cloud application. Enables configurable proximity length for custom Patterns & Phrases DLP dictionaries (with Match Any match type) and the Driver’s License (United States) predefined dictionary. Adds proximityEnabledForCustomDictionary attribute to /dlpDictionaries API endpoints to expose proximity configuration status via the Cloud Service API.
+1 more
show less
Extends Tenant Profiles feature to IBM SmartCloud application for granular account access control.
6 details in Everything
Client Connector — ZDX Module Release Summary (2024) — 2024-04-05
Apr 5, 2024
· release notes
ZDX Module 4.1 adds TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. /UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. probing for Zscaler Private Access Cloud Path on Windows
Client Connector — Release Upgrade Summary (2024) — 2024-04-05
Apr 5, 2024
· release notes
Zscaler Client Connector 4.1 adds per-OS Custom IP-Based App Bypass, Authentication Service integration, and WebView2 direct-connect options.
Try New UI icon in the upper-right of the Zscaler Client Connector Portal enables a new user interface for organizations enabled by Support.Custom IP-Based App Bypass feature configuration is now supported per OS platform via App Profiles. Public API supports disabling and logging out devices using Disable and Logout passwords. Authentication Service integration covers Strict Enforcement mode, Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , machine tunnel authentication, device groups, service entitlement, dynamic service enrollment, and device token authentication. Enable Anti-tampering setting in App Profiles can now be toggled regardless of the initial installation option.
+4 more
show less
Inbound traffic blocking for various network types supports excluding specific ports. WebView2 proxy behavior: option to have WebView2 not follow the system proxy and connect directly to the internet. macOS Detect Carbon Black, Detect CrowdStrike, and Detect SentinelOne posture checks pass if the security product is installed and running, even without a matching thumbprint. macOS device serial numbers are now visible in the Registration Details section of the Zscaler Client Connector Portal.
9 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-04-01
Apr 1, 2024
· release notes
ZPA adds Title SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attribute support and renames assistant-related API endpoints to connector.
Adds support for the Title SCIM Attribute for existing IdPs in the ZPA Admin Portal Renames GET /mgmtconfig/v1/admin/customers/{customerId}/assistantSchedule, POST /mgmtconfig/v1/admin/customers/{customerId}/assistantSchedule, and PUT /mgmtconfig/v1/admin/customers/{customerId}/assistantSchedule/{id} to use connector labels in the ZPA API
2 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-04-01
Apr 1, 2024
· release notes
Incidents page gains URL/Client IP filters and Originating User drill-down
Adds URL and Client IP filters to the Incidents page Filters section for multi-value full-text matching Adds clickable username link in the Incident Details Originating User section to filter incidents by that end user
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-04-01
Apr 1, 2024
· release notes
Adds App Segments selection to ZBC traffic forwarding rules for granular policy control
Enables selecting all app segments or specific application segment groups within Traffic Forwarding Rules
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-29
Mar 29, 2024
· release notes
ZIA adds proximity length matching to custom and US Driver's License DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries via UI/API
Adds proximityLength configuration for Custom Patterns & Phrases DLP dictionaries when Match Type is Match Any Patterns and Any Phrases Adds proximityLength configuration for the Predefined Driver’s License (United States) DLP dictionary when Confidence Score Threshold is High Updates /dlpDictionaries API endpoints with a new proximityEnabledForCustomDictionary attribute to indicate proximity length status
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-03-29
Mar 29, 2024
· release notes
Cloud & Branch Connector now supports wildcard domains and FQDNs in traffic forwarding rules.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-03-28
Mar 28, 2024
· release notes
ZPA Admin Portal adds multi-language support; automated connector updates gain retry logic.
Adds Spanish, French, German, Chinese, and Japanese language options in the ZPA Admin Portal sign-in interface Enhances App Connector and Private Service Edge automated software updates to retry failed component installations until all are upgraded
2 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-03-28
Mar 28, 2024
· release notes
Adds configurable verbose logging to Zscaler Client Connector for Android and ChromeOS.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-03-26
Mar 26, 2024
· release notes
ZPA adds AppProtection UI wizard, auto-cert gen, and autoAppProtectEnabled API field for dynamic rules
Adds Auto AppProtection and Browser Access support with a mandatory Use Untrusted Certificates selection in the Application Segment configuration UI when using untrusted certificates Adds the autoAppProtectEnabled field to the ZPA cloud service API response to indicate if an application segment's traffic is inspected by AppProtection Adds a new dynamic rule capability within the AppProtection profile via the UI wizard to inspect traffic for assigned domains Adds automatic certificate generation for AppProtection-enabled application segments, allowing selection of a Zscaler-Issued Enrollment (CA) certificate and viewing events on the Application Protocol Diagnostics page
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-22
Mar 22, 2024
· release notes
ZIA adds HTTP range header removal by URL category and extends UCaaS One Click to Webex; updates IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. API rate limits
Adds the URL Categories field under the Remove Range Headers section on the Advanced Settings page (Administration > Advanced Settings) to allow removing HTTP range headers for specific URL categories. Extends UCaaS One Click Configuration support to the Webex cloud application.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-19
Mar 19, 2024
· release notes
ZIA API enhanced for third-party app governance search.
Workflow Automation — Release Upgrade Summary (2024) — 2024-03-19
Mar 19, 2024
· release notes
Zscaler Workflow Automation adds Duplicated Incidents filter and Reset Filters icon across Admin Portal pages.
Adds a Duplicated Incidents filter on the Incidents page to show only incidents with duplicates Displays the total count of duplicate incidents next to the Transaction ID in the Incidents table Adds a Reset Filters icon to clear applied filters on Notification Templates, Survey Templates, Audit Logs, Incidents, and Incident Analytics Dashboard pages
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-03-18
Mar 18, 2024
· release notes
ZPA adds Alternative Cloud Domain selection and Only Forward Allowed Applications rule for Cloud Connectors.
Adds Alternative Cloud Domain option to override the default cloud domain for a ZPA Private Service Edge group Enables the Only Forward Allowed Applications rule action with Cloud Connector client types
2 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-03-18
Mar 18, 2024
· release notes
Client Connector 4.4.0.276 for Windows includes a new CLI capability to control anti-tampering settings, alongside various reliability and UI fixes.
Adds the ability to use the EXE file with a CLI option to disable anti-tampering after it has been enabled
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-03-15
Mar 15, 2024
· release notes
ZPA adds Only Forward Allowed Applications rule action for Cloud Connector client types.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-03-15
Mar 15, 2024
· release notes
ZDX Score Over Time graph now displays incident data on the user details page.
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-03-15
Mar 15, 2024
· release notes
VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. Agent config moves to roaming profile for restore via Citrix UPM/FSLogix
Moves the Zscaler VDI Agent's user configuration file to the user's roaming profile folder.
1 detail in Everything
Cloud & Branch Connector — Zscaler Client Connector for VDI Release Summary (2024) — 2024-03-15
Mar 15, 2024
· release notes
Zscaler Client Connector for VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. 1.1.0.8 for Windows introduces roaming profile support for user configs.
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-03-11
Mar 11, 2024
· release notes
Adds download of Zscaler VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. Agent (v1.0.0.95) from the Admin Portal.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-08
Mar 8, 2024
· release notes
ZIA adds threat severity log filtering, new DNS/Firewall rules, Source IP Groups policy criterion, and IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. report API endpoints.
Adds Threat Severity filter and column to Web Insights Logs in ZIA Admin Portal Adds %s{threatseverity} field for NSS/Cloud NSS feed output formats for web logs Adds new predefined DNS Control rules (Critical Risk DNS Categories , Critical Risk DNS Tunnels , High-Risk DNS Categories , High-Risk DNS Tunnels , Risky DNS Categories , Risky DNS Tunnels ) Adds new predefined Firewall Filtering rule: Block Malicious IPs and Domains Adds Source IP Groups criterion to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy rules (with/without content inspection, Evaluate All Rules Mode) and URL filtering policies
+5 more
show less
Adds ability to remove specific external collaborators from the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report via Analytics > SaaS Security Report > Assets Adds four new IoT report API endpoints: GET /iotDiscovery/classifications, /categories, /deviceTypes, /deviceList Adds enableIOT query parameter to GET /locations, GET /locations/lite, and GET /locations/{locationId}/sublocations for IoT discovery status Adds city, geoOverride, latitude, longitude, and iotDiscoveryEnabled fields to the Location model in API responses Displays User Risk Scores on the User Management page, allowing resets for scores higher than Low
10 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-03-08
Mar 8, 2024
· release notes
Adds wildcard FQDNs to forwarding rules, DNS gateway enhancements, new Interface/Route APIs, and gateway mode for ZT400/600/800
Supports wildcard domains and fully qualified domain names (FQDNs) in Cloud & Branch Connector traffic forwarding rules Adds GET /ecgroup/{ecgroupId}/vm/{vmId}/intf, POST /ecgroup/{ecgroupId}/vm/{vmId}/intf, GET /ecgroup/{ecgroupId}/vm/{vmId}/intf/{intfId}, PUT /ecgroup/{ecgroupId}/vm/{vmId}/intf/{intfId}, and DELETE /ecgroup/{ecgroupId}/vm/{vmId}/intf/{intfId} endpoints for managing interfaces programmatically Adds GET /ecgroup/{ecgroupId}/vm/{vmId}/route, POST /ecgroup/{ecgroupId}/vm/{vmId}/route, DELETE /ecgroup/{ecgroupId}/vm/{vmId}/route, GET /ecgroup/{ecgroupId}/vm/{vmId}/route/{ecRouteId}, and PUT /ecgroup/{ecgroupId}/vm/{vmId}/route/{ecRouteId} endpoints for managing routes programmatically Enables gateway mode deployment on Zero Trust Branch Devices (ZT400, ZT600, and ZT800) with features including WAN redundancy, LAN-to-LAN filtering, and DHCP server/client support
4 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-03-05
Mar 5, 2024
· release notes
Adds CLI option --disable-anti-tampering to EXE for Client Connector on Windows.
Adds the ability to use the EXE file with a CLI option to disable anti-tampering after it has been enabled.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-04
Mar 4, 2024
· release notes
ZIA adds three new 3rd-Party App Governance API endpoints and enriches GET /apps/app response with riskScore and instances fields.
Adds GET /apps/search endpoint to search for apps by name in the 3rd-Party App Governance API Adds GET /app_views/list endpoint to retrieve custom views configured in the Admin Portal Adds GET /app_views/{appViewId}/apps endpoint to retrieve assets related to a specified custom view Enhances GET /apps/app response to include riskScore and instances fields
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-03-04
Mar 4, 2024
· release notes
ZPA adds view of client-to-SE and SE-to-SE traffic in User Status diagnostics
Makes traffic between clients and ZPA Private/Public Service Edges visible in user status diagnostics Makes traffic between ZPA Private Service Edges and ZPA Public Service Edges visible in user status diagnostics
2 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-03-01
Mar 1, 2024
· release notes
Business Insights Admin Portal adds in-context Help Browser for all pages.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-03-01
Mar 1, 2024
· release notes
ZIA adds new predefined DNS/Firewall rules, Source IP Groups in DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /URL policies, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. API endpoints, and User Risk Scores.
Adds Source IP Groups field to Add DLP Rule and Add URL Filtering Rule windows in the ZIA Admin Portal Adds GET /iotDiscovery/classifications, GET /iotDiscovery/categories, GET /iotDiscovery/deviceTypes, and GET /iotDiscovery/deviceList endpoints to the Cloud Service API Adds enableIOT query parameter to GET /locations, GET /locations/lite, and GET /locations/{locationId}/sublocations endpoints Adds Threat Severity filter and column to Web Insights Logs and %s{threatseverity} field for NSS Cloud NSS feed output format Adds risk score display in the User Risk Profile column on the User Management page with reset capability for scores higher than Low
5 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-03-01
Mar 1, 2024
· release notes
ZDX adds OAuth authentication support for ServiceNow webhooks.
Adds OAuth as an available authentication type for ServiceNow webhook configuration Enables using OAuth credentials instead of basic auth or tokens when setting up the integration
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-29
Feb 29, 2024
· release notes
ZPA adds Privileged Remote Access API, Policy Set Controller endpoints, and PRA microtenant support.
Adds POST and PUT endpoints to the policy set controller for creating and updating policy rules via the ZPA cloud service API. Introduces customer-facing APIs for managing privileged portals, approvals, consoles, credentials, policies, and emergency access users.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The ZPA cloud service API labels previously using SRA are now changed to PRA .
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-28
Feb 28, 2024
· release notes
ZPA adds Privileged Remote Access management APIs and policy set controller endpoints.
Adds customer-facing APIs for managing privileged portals, privileged approvals, privileged consoles, privileged credentials, privileged policies, and emergency access users Exposes POST and PUT endpoints in the Policy Set Controller for creating and updating a policy rule Supports Microtenant Role-based administration control for Privileged Remote Access (PRA) with approval-based access without an authentication domain
3 details in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-02-28
Feb 28, 2024
· release notes
Zscaler Workflow Automation adds resolution label support to Close Incident API and multi-value filtering on Incidents page
Adds resolutionLabel property to the POST /dlp/v1/incidents/{dlpIncidentId}/close endpoint to assign a label and label value when closing an incident. Enables comma-separated multiple values in the Hostname, Application, User, and File Name filters on the Incidents page.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-02-28
Feb 28, 2024
· release notes
Zscaler Cloud & Branch Connector adds Interface/Route REST APIs REST APIs A convention for building HTTP-based interfaces where resources are addressed by URL and manipulated with standard verbs like GET, POST, and DELETE, giving cyber tools a predictable way to integrate with external services. , DNS gateways, sublocations, and gateway mode for ZT400/600/800.
Adds GET, POST, PUT, DELETE endpoints on /ecgroup/{ecgroupId}/vm/{vmId}/intf to manage connector interfaces programmatically Adds GET, POST, PUT, DELETE endpoints on /ecgroup/{ecgroupId}/vm/{vmId}/route to manage connector routes programmatically Supports DNS gateways and split DNS policies for enhanced DNS control within Cloud & Branch Connector Enables selection of sublocations in traffic forwarding rules, DNS filtering rules, and ZPA policies via the Admin Portal UI
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-27
Feb 27, 2024
· release notes
ZPA Private Access enables deployment on Docker platforms
Adds the ability to deploy ZPA Private Service Edge on Docker platforms.
1 detail in Everything
Private Access (ZPA) — App Connector Release Summary (2024) — 2024-02-27
Feb 27, 2024
· release notes
App Connector 24.63.3 adds AppProtection automatic certificate generation support.
Releases updated App Connector RPM packages for Red Hat Enterprise Linux 7.x and 8.x in the Manager Software update.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-02-26
Feb 26, 2024
· release notes
Zscaler Client Connector for Windows 4.2.1.199 adds --disable-anti-tampering CLI flag and fixes resource usage and traffic bypass issues.
Adds the ability to use the EXE file with a CLI option to disable anti-tampering after it has been enabled.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-02-23
Feb 23, 2024
· release notes
ZIA SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report now allows selective removal of specific external file collaborators.
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-23
Feb 23, 2024
· release notes
ZPA adds External Device ID visibility in diagnostics/logs and microtenant filtering for role-based admin.
External device MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. identifiers are now visible in ZPA User Status Diagnostics and Live Logs to associate external MDM devices with connector users Microtenant dashboards, support information, and events/notifications support is added for role-based administrators User Activity Diagnostics and Live Logs can filter requests by the originating Microtenant or by the Microtenant the application segment was shared to
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-02-22
Feb 22, 2024
· release notes
Adds wildcard domains and FQDNs as criteria for traffic forwarding rules in the Cloud & Branch Connector Admin Portal.
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-02-21
Feb 21, 2024
· release notes
Zscaler Cloud & Branch Connector Admin Portal now offers direct download of the VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. Agent (v1.0.0.95).
Admin portal adds a new download page for the Zscaler Virtual Desktop Infrastructure (VDI) Agent, allowing users to fetch version 1.0.0.95 or older available versions directly.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-02-20
Feb 20, 2024
· release notes
ZPA adds External Device ID to diagnostics/logs and Role-Based Admin enhancements for Microtenants.
External Device ID from external MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. is now available in ZPA User Status Diagnostics and Live Logs Role-based administration control supports Dashboards, Support Information, and events/notifications within a Microtenant
2 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-02-19
Feb 19, 2024
· release notes
Risk360 dashboard now lets users click Key Events on the Risk Score Trend graph to view the top 10 contributing events from the last 90 days.
Displays the top 10 key events that contributed to the risk score over the last 90 days
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-02-16
Feb 16, 2024
· release notes
ZIA adds User Risk Scores UI, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Report API endpoints, new DNS/Firewall rules, and Source IP Groups to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /URL policies.
Adds Threat Severity filter and column to Web Insights Logs Adds %s{threatseverity} field for NSS/Cloud NSS web log feeds Adds six new predefined DNS Control rules (Critical Risk/High-Risk/Risky DNS Categories & Tunnels) Adds Block Malicious IPs and Domains Firewall Filtering rule Adds Dynamics 365 tenant configuration for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API policies
+4 more
show less
Adds Source IP Groups criterion to DLP and URL filtering policies Adds four new IoT report API endpoints under /iotDiscovery/ Adds enableIOT query parameter to /locations* endpoints Adds User Risk Profile column with reset capability on User Management page
9 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-02-16
Feb 16, 2024
· release notes
ZDX adds a system-generated Top 100 Poor Score Users report and migrates ZDX Score alerts to Application rule type.
Adds a new system-generated report for the Top 100 Users with Poor ZDX Scores available in the ZDX Admin Portal Migrates existing ZDX Score alert rule type to the Application rule type for more dynamic correlation
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The ZDX Score alert rule type is no longer recommended and has been migrated to Application rule type; existing configurations will use the new type.
Client Connector — Release Upgrade Summary (2024) — 2024-02-16
Feb 16, 2024
· release notes
Zscaler Client Connector Portal 4.0.2 adds password/token obfuscation, verbose Android logging, WebView 2.0 SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. , and server-validated posture checks
Adds password and token obfuscation support for admins in the Zscaler Client Connector Portal Includes support for the verbose logging feature for Android that enables extra debug logs in the Zscaler Client Connector logs Includes support for enabling SSO for WebView 2.0 for Windows customers Adds a new posture type, Server Validated Client Certificate, that checks the client certificate against the cloud rather than only checking locally
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the Last Seen Connected to ZIA service status option for ZPA-only customers
Deception — Release Upgrade Summary (2024) — 2024-02-14
Feb 14, 2024
· release notes
Zscaler Deception adds safe process regex matching, Edge lure force-apply, ZPA connector dashboard, and UI restructure.
└──▷ HOW TO FIND IT
Navigate to the new endpoint settings location for managing agents and agent update groups.
📍 Settings › Endpoint Settings › Agents
Adds regular expression support for configuring safe processes in Zscaler Deception Adds Force Apply toggle in the Browser Lures module to disable Startup boost for Microsoft Edge lures Adds Settings > Endpoint Settings section moving Landmine options and a Show all agents toggle Adds ZPA App Connectors page at Settings > Topology > ZPA App Connector for viewing connector details and logs Removes ITDR ITDR Identity Threat Detection and Response: a discipline focused on detecting and responding to attacks that abuse identity systems such as Active Directory or IAM platforms, giving cyber tools visibility into credential-based intrusions. -Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. module from the landmine policy configuration window
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The ITDR-Active Directory module has been removed from the landmine policy configuration window
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-02-12
Feb 12, 2024
· release notes
Adds wildcard domains and FQDNs as criteria in Zscaler Cloud & Branch Connector traffic forwarding rules.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-02-09
Feb 9, 2024
· release notes
ZIA adds Threat Severity filter/column to Web Insights Logs and %s{threatseverity} field for NSS feeds.
Adds Threat Severity column and filter to Web Insights Logs in the ZIA Admin Portal Makes %s{threatseverity} field available in NSS and Cloud NSS feed configurations for web logs
2 details in Everything
Client Connector — Release Upgrade Summary (2024) — 2024-02-09
Feb 9, 2024
· release notes
Zscaler Client Connector Portal 4.0.2 adds SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for WebView 2.0, server-validated certificate posture, and verbose Android logging.
Adds support for enabling SSO for WebView 2.0 for Windows customers Adds a new posture type, Server Validated Client Certificate, that checks the client certificate against the cloud rather than only checking locally Includes support for the verbose logging feature for Android that enables extra debug logs in the Zscaler Client Connector logs
3 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-02-09
Feb 9, 2024
· release notes
Client Connector 4.4 adds Machine Tunnel device postures, CLI access, DNS TXT DNS TXT A DNS record type that stores arbitrary text strings in a domain's zone data, often used by cyber tools to exfiltrate data, verify domain ownership, or publish policy information like SPF and DMARC. support, and new portal configs for ZPA/ZIA
Adds Machine Tunnel support for File Path, Registry Key, Firewall, Full Disk Encryption, Domain Joined, and OS Version device postures. Adds the AzureAD Domain Joined posture type for devices joined to an Azure AD domain. Adds the Server Certificate posture type that validates client certificates against the cloud rather than only checking locally. Adds real-time posture checks for Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender posture types. Provides Command Line Interface (CLI) access on Zscaler Client Connector allowing admins to interact with the tool remotely via CLI.
+11 more
show less
Adds support for latency-based server configuration for ZPA. Adds support for DNS TXT records for ZPA domains. Adds a configuration in the Zscaler Client Connector Portal that restricts remote packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for administrators only. Adds new trusted network conditions in the Zscaler Client Connector Portal: Network Range, Default Gateway IP Addresses, and DHCP Server. Supports installing Windows Firewall Inbound Rule in app profiles. Supports removing existing exempted containers in app profiles. Adds a reauthenticate button to the taskbar icon menu for authenticating ZPA in advance. Allows blocking domain profile detection for various network types. Supports login_hint SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attributes to improve pre-populating the Zscaler Client Connector Username. Includes support for the Digital Experience (ZDX) Self Service feature that suggests steps to resolve potential device issues. Supports enabling SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for WebView 2.0 customers.
16 details in Everything
└──▷ BREAKING ON UPGRADE
! After upgrading to this release, users with an ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. device must re-register ZPA in Zscaler Client Connector.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-02-07
Feb 7, 2024
· release notes
ZIA isolation profiles now support disabling printing to prevent data exfiltration data exfiltration Moving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. via printed documents.
Adds ability to disable printing for ZIA Isolation Profiles, blocking right-click print, Isolation Bar print button, and browser File > Print/CTRL+P shortcuts.
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2024) — 2024-02-07
Feb 7, 2024
· release notes
Zscaler Workflow Automation adds Other Rule filter for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incidents, multi-language template translation, Product field for roles, and User Notification log.
Adds an Other Rule filter on the Incidents page to display incidents matching selected DLP rules Adds an Other Matched Rules field on the Incidents Details page to show rules that matched the violated DLP rule Adds several fields (Device Name, Device OS, Device Trust Level, File Size, ZDP Mode, Expected Action, Confirm Action, Confirm Justification, Justification Text, Additional Information) under Violation Details for Endpoint Source DLP type incidents Adds Other Rules option to Matching Policies property for Inline Source DLP type on Incident Group and Workflow Mappings pages Adds a Translate Template icon to Notification and Survey Templates pages to translate templates into different languages or revert them
+2 more
show less
Adds a Product field when configuring new roles in the Workflow Automation Admin Portal Adds a User Notification section to the Incidents Details page to track notification status and logs
7 details in Everything
Business Insights — Release Upgrade Summary (2024) — 2024-02-02
Feb 2, 2024
· release notes
Workplace Insights pages now support a last 7 days filter option.
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-02-02
Feb 2, 2024
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Discovery API endpoints, Source IP Group policy criterion, domain profiles for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules, and new DNS/Firewall filtering rules
Adds GET /iotDiscovery/classifications, /categories, /deviceTypes, and /deviceList endpoints to retrieve IoT device classifications and lists via the Cloud Service API Adds Source IP Groups as a selectable criterion in DLP policies (with/without content inspection, Evaluate All Rules), URL filtering policies, and existing firewall and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policies Adds includedDomainProfiles and excludedDomainProfiles optional fields to the /webDlpRules API endpoints to support up to 8 domain profiles in inline DLP rules Adds new predefined DNS Control rules (Critical Risk DNS Categories , Critical Risk DNS Tunnels , High-Risk DNS Categories , High-Risk DNS Tunnels , Risky DNS Categories , Risky DNS Tunnels ) and Firewall Filtering rule (Block Malicious IPs and Domains ) Adds new predefined DLP dictionaries: IBAN, Passport Number (Asia), CNPJ Number (Brazil), Mexico Unique Population Registration Code, National Economic Registry Number (Poland), Personal Identification Number (Croatia), Tax Identification Number (Luxembourg) updated for 11-digit support, and Unique Master Citizen Number
5 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-02-02
Feb 2, 2024
· release notes
ZDX adds OS filter to Overview dashboards and a new Active Users by Zscaler Destination report.
Adds an Operating System filter to the Performance Overview, Applications Overview, and User Overview pages in the ZDX Admin Portal. Adds a system-generated report for Active Users by Zscaler Destination.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-01-31
Jan 31, 2024
· release notes
ZPA adds server-side certificate posture validation and cross-edge client-to-client connectivity enhancements.
Adds server-side certificate posture validation as a configurable feature in Device Posture Profiles Enhances client-to-client connectivity to succeed across different Private Service Edges or Public Service Edges without a dedicated application segment
2 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2024) — 2024-01-31
Jan 31, 2024
· release notes
ZPA Private Service Edge 24.14.2 adds server-side certificate posture validation and fixes cross-edge client-to-client connectivity.
Ensures client-to-client connectivity across different ZPA Private or Public Service Edges without a dedicated segment
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-01-30
Jan 30, 2024
· release notes
New Privileged Remote Access (PRA) capabilities including VNC session recording and clipboard integration
Adds support for File Transfer with VNC for Privileged Remote Access sessions Enables Clipboard access and Session Proctoring for Privileged Remote Access Introduces Allocated credentials and Time-bound access controls for Privileged Remote Access Removes concurrency restrictions for Privileged Remote Access users
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-01-26
Jan 26, 2024
· release notes
ZIA adds Domain Profiles in Inline DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , new PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries, File Type Control for archives, and IP surrogacy for non-cookie auth.
Adds includedDomainProfiles and excludedDomainProfiles optional fields to /webDlpRules API endpoints to control email recipient domain profiles in inline DLP rules Enables selection of up to 8 email recipient domain profiles within DLP policy rule criteria for Gmail and Outlook with and without content inspection Adds predefined DLP detection for hierarchical PII dictionaries: IBAN (47 countries) and Passport Number (Asia, 8 countries) Adds predefined DLP numeric PII dictionaries: CNPJ Number (Brazil), Mexico Unique Population Registration Code, National Economic Registry Number (Poland), Personal Identification Number (Croatia), Tax Identification Number (Luxembourg), and Unique Master Citizen Number Extends File Type Control policy Archive category with new file types: .alz, .b64, .bh, .dact, .lrzip, .lz4, .lzip, .lzma, .lzop, .rzip, .zpaq, and .zst
+1 more
show less
Supports IP surrogacy from known browsers for non-cookie authentication methods (Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , digest, basic) via new Supported Authentication Methods field in location configuration
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-01-19
Jan 19, 2024
· release notes
ZIA adds non-cookie IP surrogacy, new file types for control policies, and updated DPI app detection.
Supported Authentication Methods field available when configuring locations to enable IP surrogacy for known browsers with Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , digest, or basic authenticationFile Type Control policy supports ALZ (.alz), B64 (.b64), BH (.bh), DACT (.dact), LRZIP (.lrzip), LZ4 (.lz4), LZIP (.lzip), LZMA (.lzma), LZOP (.lzop), RZIP (.rzip), ZPAQ (.zpaq), and ZST (.zst) archive file types
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-01-19
Jan 19, 2024
· release notes
ZPA adds Source IP Anchoring dashboard to monitor usage and metrics
Workflow Automation — Release Upgrade Summary (2024) — 2024-01-18
Jan 18, 2024
· release notes
Workflow Automation adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident deletion API, analytics dashboard, multi-language template support, and new incident filters.
Adds DELETE /dlp/v1/incidents/{dlpIncidentId} endpoint to remove DLP incidents by ID Adds Incident Analytics page in Admin Portal for high-level DLP visibility Adds Add Template option, Template Family and Language filters, Template Family column, and Translate action for notification/survey templates Adds File Name and File Type filters to the Incidents page Adds Language drop-downs in Notify User/Escalate windows on Incident Details and Notification Channel field on Workflows
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-01-17
Jan 17, 2024
· release notes
ZPA adds App Connector and Private Service Edge support for KVM KVM A Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed. /qcow2 images.
New App Connector images are available in the KVM qcow2 format to support Equinix Network Edge. New ZPA Private Service Edge images are available in the KVM qcow2 format to support Equinix Network Edge.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-01-16
Jan 16, 2024
· release notes
ZPA adds Redirection Policy rules and API support for bulk updating policy rule order.
Adds Redirection Policy rules to prefer ZPA Private Service Edges over Public Service Edges based on country code, client type, or geographical proximity Adds cloud service API capability to bulk update the order of all rules within a policy set
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2024) — 2024-01-16
Jan 16, 2024
· release notes
New AWS tagging support in security policies and VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. Agent capability.
Adds support for applying security policies by leveraging AWS user-defined tags and attributes for workloads Introduces the Zscaler VDI Agent, a lightweight Windows application that runs in the VDI session user space to authenticate multiple users and exchange user context
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2024) — 2024-01-12
Jan 12, 2024
· release notes
ZIA adds new Admin settings for block/connect SNI SNI A TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. mismatch and non-cookie IP surrogacy support
Adds Block CONNECT Host and SNI Mismatch option to Advanced Settings to block forward proxy connections where the CONNECT host doesn't match the SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS client hello SNI Adds Prefer SNI over CONNECT Host for DNS Resolution option to Advanced Settings to use the SSL/TLS client hello SNI for DNS resolution instead of the CONNECT host Enables IP surrogacy from known browsers for non-cookie authentication methods (Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. , digest, basic) via a new Supported Authentication Methods field when configuring locations Expands File Type Control policy to include 13 new archive file types: .alz, .b64, .bh, .dact, .lrzip, .lz4, .lzip, .lzma, .lzop, .rzip, .zpaq, and .zst
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2024) — 2024-01-12
Jan 12, 2024
· release notes
ZDX adds automatic root-cause analysis for poor scores and probe-configurable reverse Cloud Path
Adds preselected application tile and automated root-cause analysis on the User Details page when a Poor ZDX Score is present Adds Reverse Cloud Path option in Probe configuration to bypass network devices blocking forward traffic
2 details in Everything
Client Connector — Client Connector App Release Summary (2024) — 2024-01-12
Jan 12, 2024
· release notes
Client Connector 1.14 adds Android 14 support, ZIA/ZPA disaster recovery, and new log export fields.
Supports Android OS 14 Supports Disaster Recovery for Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) Saves device properties from /system/bin/getprop in logs
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the Knox Admin and all Knox functionality from Zscaler Client Connector
Private Access (ZPA) — Release Upgrade Summary (2024) — 2024-01-11
Jan 11, 2024
· release notes
ZPA Isolation file upload/download limit raised to 1GB (2GB for multi-file) and connector pages now show last known IP addresses
Isolation file download and upload size limit increased to 1 GB per file (2 GB for multiple files)App Connectors and Private Service Edges tables add Last Known Public IP and Last Known Private IP fields on disconnect
2 details in Everything
Risk360 — Release Upgrade Summary (2024) — 2024-01-11
Jan 11, 2024
· release notes
Risk360 adds CrowdStrike integration for risk factor visibility
Business Insights — Release Upgrade Summary (2024) — 2024-01-10
Jan 10, 2024
· release notes
Zscaler Business Insights launches with SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. usage/spending visibility and workplace utilization metrics.
Adds Business Insights service providing 360-degree visibility into SaaS application usage and spending.
1 detail in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-12-18
Dec 18, 2023
· release notes
Adds China deployment support for Zscaler Cloud Connector on Azure
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-12-18
Dec 18, 2023
· release notes
ZPA introduces Session Proctoring for live privileged session monitoring and new Privileged Consoles limits.
Enables Session Proctoring to join, monitor, and share live privileged sessions via Privileged Capabilities Policies. Allows management of live privileged sessions via the new Live tab on the Privileged Sessions page.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-12-15
Dec 15, 2023
· release notes
ZDX now provides system-generated reports for ZDX Score by Applications and Wi-Fi Distribution in the Admin Portal.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-15
Dec 15, 2023
· release notes
ZIA adds Workload Groups policy criterion and two new Advanced Settings options for DNS/SNI SNI A TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. handling
Adds Workload Groups page in Administration menu to create groups for tagging public cloud workloads (e.g., AWS). Adds workloadGroups field to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Firewall Filtering, URL Filtering, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies. Adds GET /workloadGroups API endpoint to retrieve preconfigured workload group lists. Adds workloadGroups attribute support in /firewallFilteringRules, /webDlpRules, and /urlFilteringRules API endpoints. Adds Block CONNECT Host and SNI Mismatch option in Advanced Settings.
+1 more
show less
Adds 'Prefer SNI over CONNECT Host for DNS Resolution' option in Advanced Settings.
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-12-15
Dec 15, 2023
· release notes
Cloud & Branch Connector adds AWS User-Defined Tags support in Security Policies and a new Zscaler VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. Agent.
Adds support for applying security policies based on AWS User-Defined Tags and Attributes for workloads Introduces the Zscaler VDI Agent, a lightweight Windows application that runs in the VDI user space to authenticate users and establish tunnels to Cloud or Branch Connector
2 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-12-14
Dec 14, 2023
· release notes
Client Connector 4.2 adds ZSLogin SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. integration, ZPA app expiration notifications, Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support, HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. downloads, and alternate cloud domains.
Supports using a preferred port to enable Zscaler Client Connector to ZIA communication Supports the integration of the ZSLogin platform for single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. (SSO) across all Zscaler services via the ZSLogin Admin Portal Assigns a virtual IP address to Zscaler Client Connector to support Server-to-Client applications like remote troubleshooting and software distribution Supports including browser-based configurations in keepalive policy downloads Implements end-user notifications notifying users in advance of their access to ZPA apps expiring
+8 more
show less
Supports blocking access to keyboard shortcuts and the drag-and-drop procedure in Zscaler Client Connector WebBrowser Control (WBC) Supports configuring dynamic (ZIA) Public Service Edge use based on latency settings for the probe interval, frequency, and threshold limits Displays Device Trust Levels in the Zscaler Client Connector Portal based on the configured levels in ZIA Posture Profiles Adds additional end-user notification controls such as custom timer, enable persistent notifications, and ZIA notification persistent in the Zscaler Client Connector Portal Supports integration of Endpoint Data Loss Prevention (DLP) service with Zscaler Client Connector Adds support for downloading the default PAC file using HTTPS Supports bypassing applications using the transparent proxy system extension based on the defined process name Adds Alternate Cloud Domain support for both ZIA and ZPA to support better services in China
13 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-12
Dec 12, 2023
· release notes
ZIA adds Block CONNECT Host and SNI Mismatch and Prefer SNI over CONNECT Host options to Advanced Settings.
Adds the Block CONNECT Host and SNI Mismatch toggle in Administration > Advanced Settings to block forward proxy connections where the CONNECT host doesn't match the SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. /TLS client hello SNI SNI A TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. Adds the Prefer SNI over CONNECT Host for DNS Resolution toggle in Administration > Advanced Settings to use the SSL/TLS client hello SNI for DNS resolution instead of the CONNECT host
2 details in Everything
Risk360 — Release Upgrade Summary (2023) — 2023-12-12
Dec 12, 2023
· release notes
Risk360 adds MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. and NIST CSF NIST CSF The NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. analysis pages, Monte Carlo simulation for loss probability, score change audit logs, and new risk reports
Adds Frameworks > MITRE ATT&CK page for assessing security posture using MITRE MITRE A US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. framework Adds support for NIST Cybersecurity Framework NIST Cybersecurity Framework The NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. (CSF CSF The NIST Cybersecurity Framework, a set of outcomes for managing cybersecurity risk. Organizations use it to describe their current posture, priorities and improvement goals. ) analysis within Risk360 Adds Financial Risk > Monte Carlo Simulation to show probability of loss for risk scores Adds Score Change Logs tab on the Audit Logs page to view event logs contributing to score changes Makes CISO Board Slides, Attack Surface Report, Cybersecurity Maturity Assessment, SEC Disclosures, and Miscellaneous reports available from the Reports page
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-12-12
Dec 12, 2023
· release notes
Zscaler Private Access App Connectors can now be deployed on Red Hat OpenShift.
Adds App Connector deployment support for the Red Hat OpenShift platform
1 detail in Everything
Workflow Automation — Release Upgrade Summary (2023) — 2023-12-11
Dec 11, 2023
· release notes
Auto-populated manager email on incident escalation and improved digest notification accuracy.
Adds auto-population of the user's manager email to the Escalate window in the Incident Details page (read-only). Improves digest notifications for Email, Slack, and Microsoft Teams to clarify that incident counts are accurate only at generation time.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-12-11
Dec 11, 2023
· release notes
Zscaler Branch Connector now supports deployment on Zero Trust Branch Device 400 (ZT400).
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-12-11
Dec 11, 2023
· release notes
ZPA adds Intelligent Application Segmentation activation and RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. /DigiCert support in 2023-12-11 update
Adds ability to activate ZPA Intelligent Application Segmentation on the Recommended Application Segments page. Adds support for Red Hat Enterprise Linux 7.x and 8.x via new App Connector and Private Service Edge RPM packages. Adds support for DigiCert G2 certificates in App Connector and Private Service Edge software.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-08
Dec 8, 2023
· release notes
ZIA adds Evaluate All Rules mode for Inline DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , GCP Tenant Profile support, and API fields
Adds Evaluate All Rules mode in DLP Advanced Settings (Administration > DLP Advanced Settings) to evaluate all configured inline DLP rules instead of stopping at the first match, enforcing the most restrictive action. Adds DLP Severity as a new column and filter field on the Web Insights Logs page (Analytics > Web Insights > Logs). Adds parentRule, subRules, and severity attributes to the /webDlpRules API endpoints for exception rule configuration. Adds Google Cloud Platform support to Tenant Profiles, allowing restriction of users by GCP organization ID. Adds macOS 12, 13, and 14 endpoint support for Endpoint DLP.
+9 more
show less
Enables importing DLP resources via CSV files in Endpoint DLP. Enables grouping DLP resources in Endpoint DLP. Adds support for Google Drive (Personal) and iCloud (macOS) data sources in Endpoint DLP. Increases the limit of exception rules per parent rule to 32 in Endpoint DLP. Supports password-protected and encrypted files in Endpoint DLP. Adds Media Transfer Protocol (MTP) external storage device support for Endpoint DLP. Enables Block action for file copies to network shares from Windows endpoints in Endpoint DLP. Adds deletion of all exception rules when a parent rule is deleted in Endpoint DLP. Adds predefined DLP dictionaries: Bulgaria Uniform Civil Number, Credentials and Secrets, Driver’s License (United States), Passport Number (European Union), VAT Number (Austria/Belgium/France/Germany/Luxembourg/Netherlands).
14 details in Everything
Client Connector — Release Upgrade Summary (2023) — 2023-12-08
Dec 8, 2023
· release notes
Zscaler Client Connector Portal 4.0.1 adds PMTUD default and slow rollout controls
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-05
Dec 5, 2023
· release notes
ZIA adds Evaluate All Rules mode for Inline DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. with exception rules and updated API endpoints
Adds Evaluate All Rules mode to the Zscaler service for inline DLP policy evaluation, enforcing the most restrictive action across all configured rules rather than relying on rule order. Adds severity field configuration and child exception rule support (allowing exclusion of specific users or groups) when Evaluate All Rules mode is enabled. Updates the /webDlpRules API endpoints to include new attributes: parentRule, subRules, and severity for exception rule configuration.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-12-01
Dec 1, 2023
· release notes
ZDX adds exclusion filters to alert rules and a new system-generated Application Performance report
Adds an exclusion option in Alert Rule configuration filters to omit specific items from filtering logic Introduces the Report for Application Performance as a new system-generated view in the ZDX Admin Portal
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-12-01
Dec 1, 2023
· release notes
ZIA adds Evaluate All Rules mode for Inline DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Endpoint DLP CSV imports, and new DLP dictionary support.
Adds Evaluate All Rules mode to inline DLP policy evaluation via the DLP Advanced Settings page in the ZIA Admin Portal Adds parentRule, subRules, and severity attributes to the /webDlpRules API endpoint for exception rule configuration Adds DLP Severity as a new filter and column field in Web Insights Logs Adds support for importing DLP resources via CSV files in Endpoint DLP Adds support for Google Drive (Personal) and iCloud (macOS) in Endpoint DLP
+4 more
show less
Adds support for external storage devices using Media Transfer Protocol (MTP) in Endpoint DLP Adds new predefined DLP dictionaries including Bulgaria Uniform Civil Number, Credentials and Secrets, US Driver’s License, EU Passport Number, and VAT Numbers for Austria, Belgium, France, Germany, Luxembourg, and Netherlands Increases the limit to 32 exception rules per parent rule in Endpoint DLP Adds Event and Metrics log types support for Zscaler Cloud & Branch Connector via NSS and Cloud NSS feeds
9 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-12-01
Dec 1, 2023
· release notes
Release summary covers Windows Client Connector 4.2.1 enhancements including unattended mode support, anti-tampering improvements, and alternate cloud domain support for China, alongside various stability and connectivity fixes.
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-12-01
Dec 1, 2023
· release notes
Cloud & Branch Connector adds Event and Metrics log types for NSS and Cloud NSS feeds in the Admin Portal.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-12-01
Dec 1, 2023
· release notes
ZPA Admin Portal updates remove the Status column from connector management tables to simplify interface layouts.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-11-30
Nov 30, 2023
· release notes
New Peak Inspection Tunnel Count widget and Inspection Status filter in ZPA Private Access dashboards
Adds Peak Inspection Tunnel Count in Past 14 Days widget to the App Connector Dashboard for capacity visibility. Adds Logs: Inspection Status filter on the User Activity Diagnostics page.
2 details in Everything
Workflow Automation — Release Upgrade Summary (2023) — 2023-11-29
Nov 29, 2023
· release notes
New API endpoint for audit logs, incident deletion export, role management UI, and mapping enhancements
Adds POST /dlp/v1/customer/audit endpoint to filter admin and API audit logs by time period and field values Adds delete action on Incident Details page to remove incidents directly Adds export icon on Incidents page to download incidents as a CSV file Adds EQUALS, NOT_EQUALS, CONTAINS_EXACT, and NOT_CONTAINS_EXACT operations for case-insensitive incident group and workflow mappings Adds Priority filter to Incidents page to filter by high and critical priorities
+2 more
show less
Adds new Roles page in Setup > Roles and Permissions menu to create roles and assign permissions Adds Roles field to Setup > Admins > Add Admins window for multi-role admin assignment
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-17
Nov 17, 2023
· release notes
ZIA adds Zscaler Cloud & Branch Connector log types to NSS/Cloud NSS feeds, GCP support in Tenant Profiles, and OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. .
Supports Event and Metrics log types from Zscaler Cloud & Branch Connector via Nanolog Streaming Service (NSS) and Cloud NSS feeds Adds Google Cloud Platform as a supported platform in Tenant Profiles to restrict users by GCP organization ID Enables OCR support for SaaS Security API Data Loss Prevention (DLP) with organization-wide OCR settings
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The ocrEnabled attribute in the /webDlpRules API endpoints has been deprecated as the OCR configuration is no longer supported on a per-DLP rule basis.
Client Connector — Release Upgrade Summary (2023) — 2023-11-17
Nov 17, 2023
· release notes
Zscaler Client Connector Portal 4.0 introduces CLI operations, unattended password auth, and real-time posture detection for Process Check and EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. agents.
Provides a CLI to perform various operations in the Zscaler Client Connector Supports passwords for upgrade, uninstall, and revert in unattended mode Adds real-time posture checks for Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender Supports cloning Forwarding Profiles in the Portal Adds slow rollout capability for Zscaler Client Connector upgrades via App Store configuration
+7 more
show less
Adds option to install the Zscaler App Inbound Rule to the Windows Firewall in App Profiles Adds a field on the Device Details page in Enrolled Devices to identify if an Imprivata user is logged in Replaces HTTP-based probing with ICMP-based probing for improved performance Adds 64-bit support for Zscaler Digital Experience (ZDX) Adds the Azure AD Domain-Joined posture type to identify the tenant ID Allows admins to see the active tunnel SDK version on the Device Details page Adds additional end-user notification controls such as custom timer, enable persistent notifications, and ZIA notification persistent in the Portal for macOS
12 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-11-17
Nov 17, 2023
· release notes
Adds ability to configure Event and Metrics logs for NSS and Cloud NSS feeds in the Admin Portal.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-11-17
Nov 17, 2023
· release notes
ZPA adds KVM KVM A Linux kernel module that turns the kernel into a hypervisor, letting a process run fully isolated virtual machines using hardware virtualisation extensions. Cyber tools use it to sandbox execution environments at near-native speed. qcow2 image support for Equinix Network Edge deployments.
Client Connector — Client Connector App Release Summary (2023) — 2023-11-14
Nov 14, 2023
· release notes
ChromeOS 1.13 adds SIM carrier/IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. keepalive tracking and multiple ZPA trusted networks; Linux 1.5.0.37 fixes dark mode text.
Adds the ability to track SIM carrier and connected interface IPv6 status in the keepalive message for ChromeOS. Allows configuration of multiple trusted networks for use with Zscaler Private Access (ZPA) applications on ChromeOS.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-11-13
Nov 13, 2023
· release notes
Zscaler Branch Connector now supports deployment on Zero Trust Branch Devices
Client Connector — ZDX Module Release Summary (2023) — 2023-11-10
Nov 10, 2023
· release notes
ZDX Module 4.0 adds reverse traceroute visibility, REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. error reasons, Egress IP substitution, and 64-bit support.
Adds visibility of underlay hops through reverse traceroute from ZIA Public Service Edge or Private Service Edge when ICMP responses are blocked. Provides the specific error reason for REST API failures instead of generic errors. Changes Cloud Path probe ports to use UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. on the translation port in DNAT environments. Supports running the ZDX Module as a 64-bit application on Windows (contact Account team to enable). Substitutes Periphery router IP with the Egress IP obtained from the Zscaler Service API when public IPs are used.
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-10
Nov 10, 2023
· release notes
ZIA adds Virtual Service Edge IPSec local termination, Webex DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. quarantine, HTTP/2 support, and new Cloud API endpoints for forwarding rules and ZPA gateways.
Adds GET, POST, PUT, and DELETE endpoints for /forwardingRules and /zpaGateways to manage forwarding control and ZPA gateway resources via the Cloud Service API. Enables HTTP/2 as the default web protocol for organizational applications and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection rules via new settings in Administration > Advanced Settings and Policy > SSL Inspection. Adds quarantine capability for sensitive content in Webex Teams with configurable tombstone messages via the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP Control policy. Adds Activity Role Type filter to the SaaS Activities Report to isolate actions by specific user roles. Introduces new predefined medical DLP dictionaries: Diseases Information , Drugs Information , and Treatments Information .
+3 more
show less
Adds Minimum and Maximum File Size (KB) limits to File Type Control rules. Supports OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for SaaS Security API DLP with organization-level configuration in Administration > DLP Advanced Settings, removing per-rule ocrEnabled attribute support. Adds Tenant Profile support for Google Cloud Platform to restrict users by organization ID.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! The ocrEnabled attribute in the /webDlpRules API endpoints is deprecated and no longer supported for per-DLP rule configuration.
Client Connector — Release Upgrade Summary (2023) — 2023-11-10
Nov 10, 2023
· release notes
Zscaler Client Connector Portal 4.0 adds unattended mode passwords, new trusted network conditions, and real-time posture checks for EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. agents.
Supports passwords for upgrade, uninstall, and revert in the unattended mode Adds the option to use the SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. -based login_hint parameter to populate the username field automatically Adds additional end-user notification controls such as custom timer, enable persistent notifications, and ZIA notification persistent in the Zscaler Client Connector Portal for macOS Supports cloning Forwarding Profiles in the Zscaler Client Connector Portal Adds the Azure AD Domain-Joined posture type for Zscaler Client Connector to identify the tenant ID
+3 more
show less
Supports real-time posture checks for Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender posture types Adds a configuration to manage the removal of existing exempted app containers from the firewall configuration Provides a similar Zscaler Client Connector experience using the CLI to perform various operations
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-09
Nov 9, 2023
· release notes
ZIA adds multiple domain support, user count/risk filters, and app notes to 3rd-Party App Governance
The Inbound tab in the 3rd-Party App Governance Integrations window now allows adding multiple instances (domains) of a given SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. platform and viewing their status, sync dates, and list. App Inventory filters now support user count and risk score parameters (bigger than, smaller than, within range) plus a risk rating filter for low/medium/high scores. Users can add custom notes, notations, and scores to an app from the App Panel header in 3rd-Party App Governance.
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-11-08
Nov 8, 2023
· release notes
Zscaler Branch Connector now supports deployment on Zero Trust Branch Devices
Private Access (ZPA) — App Connector Release Summary (2023) — 2023-11-07
Nov 7, 2023
· release notes
App Connector 23.313.1 adds Red Hat OpenShift Platform support and updates modsecurity/PCRE libraries.
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2023) — 2023-11-07
Nov 7, 2023
· release notes
ZPA adds redirection policy rules and RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 7/8 support for managers.
Supports Redirection Policy rules for Private Service Edge.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-07
Nov 7, 2023
· release notes
ZIA adds pageId to POST /dlp/v1/incidents/search for pagination and incident filtering enhancements.
Adds pageId parameter to the POST /dlp/v1/incidents/search endpoint for efficient result paging. Enables saving and reusing incident filters on the Incidents page UI.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-11-07
Nov 7, 2023
· release notes
ZPA adds App Connector support for Red Hat OpenShift and updates RPM packages for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 7/8.
Adds Red Hat OpenShift Platform as a supported deployment target for App Connectors Updates App Connector and ZPA Private Service Edge RPM packages for Red Hat Enterprise Linux 7.x and 8.x
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-11-03
Nov 3, 2023
· release notes
ZIA adds HTTP/2 support, OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , new forwarding/ZPA APIs, and report exports
└──▷ TRY IT
Manage forwarding rules programmatically via the new REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. .
copy
$ GET /forwardingRules
Configure organization-wide OCR for SaaS DLP in the admin portal.
📍 Administration › DLP Advanced Settings
Adds GET /forwardingRules, POST /forwardingRules, PUT /forwardingRules/{ruleId}, DELETE /forwardingRules/{ruleId}, GET /users/references endpoints for forwarding rule management. Adds GET /zpaGateways, POST /zpaGateways, PUT /zpaGateways/{gatewayId}, DELETE /zpaGateways/{gatewayId} endpoints for ZPA gateway management in forwarding rules. Enables Optical Character Recognition (OCR) configuration at the organization level for SaaS Security API DLP via the Administration > DLP Advanced Settings page, removing the need to configure OCR per individual rule.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The ocrEnabled attribute in the /webDlpRules API endpoints is deprecated as OCR configuration is no longer supported on a per-DLP rule basis.
Client Connector — Release Upgrade Summary (2023) — 2023-11-03
Nov 3, 2023
· release notes
Client Connector Portal 4.0 adds CLI support, unattended password auth, and new posture checks
Provides a similar Zscaler Client Connector experience using the CLI to perform various operations. Supports passwords for upgrade, uninstall, and revert in the unattended mode. Supports real-time posture checks for Process Check, Detect Carbon Black, Detect CrowdStrike, Detect SentinelOne, and Detect Microsoft Defender. Adds the Azure AD Domain-Joined posture type for Zscaler Client Connector to identify the tenant ID. Supports cloning Forwarding Profiles in the Zscaler Client Connector Portal.
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Replaces HTTP-based probing with ICMP-based probing for improved performance.
Deception — Release Upgrade Summary (2023) — 2023-11-02
Nov 2, 2023
· release notes
Deception adds CrowdStrike containment sync, AWS tag management, cloud decoy deletion, and UI enhancements.
Adds automated synchronization of CrowdStrike containment status with Zscaler Deception to keep the Posture Control portal in sync. Adds the ability to delete Cloud Deception settings for Microsoft Azure via Deceive > Cloud Deception > Azure > Settings. Adds the ability to delete Cloud Deception settings for Amazon Web Services via Deceive > Cloud Deception > AWS > Settings. Adds the option to add tags to decoys and resources on AWS directly from the Zscaler Deception Admin Portal at Deceive > Cloud Deception > AWS > Settings. Changes Event Score Calculation for ThreatParse rules to use the highest score among matching rules instead of summing them.
+3 more
show less
Adds new columns Type (Static, Dynamic, or High Interaction) and Public IP to the Threat Intelligence Decoys page, removing Internal NAT IP. Adds a copy-to-clipboard button to the Download Deployment Script window for both Azure and AWS. Adds mouseover tooltip showing last log upload date to the Download logs icon in the Agents table.
8 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-10-27
Oct 27, 2023
· release notes
ZIA adds HTTP/2 protocol support, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. medical dictionaries, File Type Control size limits, and new Cloud Service API endpoints.
└──▷ TRY IT
Query browser isolation profiles via the new dedicated API endpoint.
copy
$ GET /browserIsolation/profiles
Adds ISOLATE action and cbiprofile parameter to URL filtering rule endpoints Adds GET /browserIsolation/profiles endpoint for browser isolation profiles Adds forwarding control and ZPA gateway CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. endpoints Adds Response HTTP Version data type to Dashboard widgets Adds Request Version and Response HTTP Version filters/columns to Web Insights Logs
+3 more
show less
Enables HTTP/2 as default web protocol in Advanced Settings Adds Diseases Information , Drugs Information , and Treatments Information medical DLP dictionaries Adds minimum and maximum file size limits to File Type Control rules
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-10-25
Oct 25, 2023
· release notes
Auto-delete for disconnected App Connectors via UI/API, Private Service Edge label rename, policy search API support
Adds autoDelete configuration in the Admin Portal to remove disconnected App Connectors after a set number of days Renames Service Edge labels to Private Service Edge in the ZPA Admin Portal UI Supports searching by policy rule action via the ZPA API endpoint for getting the policy set ID by policy type
3 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-10-23
Oct 23, 2023
· release notes
Zscaler Cloud Connector now supports deployment on the Google Cloud Platform (GCP).
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-10-20
Oct 20, 2023
· release notes
Zscaler Cloud Connector adds Auto Scaling and Medium/Large VM size support via Cloud Provisioning Template updates.
Enables Auto Scaling for Zscaler Cloud Connector deployments via the Cloud Provisioning Template Supports Medium and Large virtual machine sizes through the Cloud Provisioning Template
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-10-19
Oct 19, 2023
· release notes
ZIA Workflow Automation adds incident reopening, deletion, configurable columns, and template mapping UI
Adds ability to reopen closed incidents via the Reopen button on the Incident Details page Enables viewing duplicate incidents through a link on the Incident Details page Makes table columns on the Incidents page configurable by the user Allows deletion of workflows via the Delete Workflow Settings icon on the Workflows page Redesigns the Template Mapping page with dedicated Add and Edit windows for incident template mappings
5 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-10-16
Oct 16, 2023
· release notes
Zscaler Cloud Connector now supports deployment on Google Cloud Platform (GCP)
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-10-13
Oct 13, 2023
· release notes
ZIA adds new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries, Shift JIS support, MS Chromium Edge user-agent criteria, custom Shadow IT app reporting, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. quarantine improvements, and three new Cloud
PUT /cloudApplications/bulkUpdate, GET /cloudApplications/lite, and GET /customTags endpoints for managing cloud applications and tags via APIMS Chromium Edge user-agent criterion in URL Filtering, Cloud App Control, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies Shift JIS Encoding support in Zscaler DLP engines for Japanese text extraction Quarantine to user root folder and tombstone templates support in SaaS Security API DLP policies Custom application filtering in the Shadow IT Report under the Custom Applications option in the Application Category filter
5 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-10-13
Oct 13, 2023
· release notes
Client Connector 4.3.0.131 for Windows adds policy download optimization and fixes reinstall policy token update issues.
Adds optimizations to reduce the frequency of policy download requests on the Zscaler Client Connector Portal server. Fixes an issue with Zscaler Client Connector policy update when Zscaler Client Connector is reinstalled with a new policy token.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-10-09
Oct 9, 2023
· release notes
ZPA isolation profiles gain flattened PDF downloads, persistent banners/URL bar, and custom watermarks.
Enables flattened PDF file transfer option in ZPA isolation profiles to download files without active content Adds persistent isolation banner setting per isolation profile to keep the notification visible for the session duration Adds persistent isolation URL bar option per isolation profile to display the URL during the isolation session Introduces watermarking capability in isolation profiles allowing display of user ID, date/timestamp, and custom message
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-10-06
Oct 6, 2023
· release notes
ZIA adds MS Chromium Edge criteria, custom Shadow IT app reporting, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. root folder quarantine, and new Cloud Apps API endpoints.
Adds MS Chromium Edge as a distinct user-agent criterion in URL Filtering, Cloud App Control, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies. Adds PUT /cloudApplications/bulkUpdate, GET /cloudApplications/lite, and GET /customTags endpoints to the ZIA Cloud Service API. Enables quarantining DLP violations to the user root folder in SaaS Security API File Sharing Apps. Adds filtering for custom applications in the Shadow IT Report via the Application Category filter.
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-10-02
Oct 2, 2023
· release notes
Azure VM for Zscaler Cloud Connector now supports encryption at host for end-to-end VM data protection
Adds the option to enable encryption at host on the Microsoft Azure virtual machine (VM) for Zscaler Cloud Connector, providing end-to-end encryption for VM data. Deploys this update across all Zscaler cloud platforms: connector.zscaler.net, connector.zscalertwo.net, connector.zscalerthree.net, and connector.zscloud.net.
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-09-29
Sep 29, 2023
· release notes
ZDX adds filter interaction for probe criteria, search filters on Probes page, and Autosense for Microsoft Teams Call Quality.
Adds filter inclusion/exclusion support to probing criteria when configuring a new probe in the ZDX Admin Portal. Adds ZDX Autosense for Microsoft Teams Call Quality, which dynamically detects destination IP/port and creates a Cloud Path probe upon tenant onboarding.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-29
Sep 29, 2023
· release notes
ZIA adds MS Chromium Edge user-agent criterion, custom app Shadow IT support, Shift JIS DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , new PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries, and Cloud Service API endpoints.
PUT /cloudApplications/bulkUpdate, GET /cloudApplications/lite, and GET /customTags endpoints added to Cloud Service APISupport for MS Chromium Edge user-agent criteria in URL Filtering, Cloud App Control, and SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies Shadow IT Report now displays and filters by custom applications via the Custom Applications option under the Application Category filter DLP engines support Shift JIS encoding for Japanese text extraction from files New predefined DPI dictionaries added: National Health Index Number (New Zealand), Tax Identification Number (Finland/Ireland/Greece/Peru/Poland/Spain/CIF/US), VAT Number (Ireland), Australia Passport Number, Bulgaria Uniform Civil Number (EGN), National Provider Identifier, Social Security Number (Austria)
5 details in Everything
└──▷ BREAKING ON UPGRADE
! MS Chromium Edge is separated from Microsoft Edge browser type; policies configured for Microsoft Edge must also be updated to MS Chromium Edge to maintain consistency
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-26
Sep 26, 2023
· release notes
ZIA adds critical incident priority, new user attributes to incidents, and a Support User Role ARN field for AWS DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. integration.
Adds critical as a new priority level for incidents in Workflow Automation Enables Support User Role ARN field on the AWS Zscaler DLP Integration page to streamline support troubleshooting Displays Manager Name, Manager Email, and Department attributes in the Violation Details section of Incident Details
3 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-09-25
Sep 25, 2023
· release notes
Zscaler Client Connector 1.13 for Android adds ZPA private broker support and multiple trusted networks.
Supports using a private Zscaler Private Access (ZPA) broker installed and managed by customers in their own network Allows configuration of multiple trusted networks for use with ZPA applications
2 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes support for the Client Certificate posture check on Samsung Android devices! Removes support for Device Admin for new installs on Samsung Android devices
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-25
Sep 25, 2023
· release notes
ZPA adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. group member counts, SCIM user attribute filtering, and API sort capability for SCIM groups.
Adds total count and active users metrics to the SCIM Groups page in the ZPA Admin Portal Adds ability to filter by SCIM attributes on the SCIM Users page in the ZPA Admin Portal Adds sort capability when fetching SCIM groups using the ZPA cloud service API
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-22
Sep 22, 2023
· release notes
ZIA adds EDM with No Primary Keys, Slack Canvas DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Zscaler Cloud & Branch Connector NSS support, and API field for Names dicts
Adds EDM with No Primary Keys option to the DLP Advanced Settings page in the ZIA Admin Portal, allowing Exact Data Match policies to use templates without primary fields. SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP and Malware Detection policies now support scanning files and messages in Slack Canvas.Supports configuring Cloud NSS for Zscaler Cloud & Branch Connector by selecting NSS for Firewall, Cloud and Branch Connector as the NSS type in the Admin Portal. Predefined DLP dictionaries (Names Canada, Spain, US and NDC Number Package/Product) now support an Action option to configure how matching items are evaluated.
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-09-22
Sep 22, 2023
· release notes
Adds Cloud NSS Feeds for cloud-to-cloud log streaming from the Zscaler Cloud & Branch Connector to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. without deploying an NSS VM.
Enables Cloud NSS Feeds allowing instant stream of logs from the Zscaler Cloud & Branch Connector Admin Portal directly into a cloud-based SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. system, removing the requirement to deploy a separate NSS virtual machine.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-19
Sep 19, 2023
· release notes
ZIA adds Mobile User Experience in Isolation for iOS and Android browsers.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-19
Sep 19, 2023
· release notes
ZPA adds mobile isolation support on iOS/Android and limited availability auth extension during PSE cloud outages.
Adds Mobile User Experience in Isolation for ZPA, supporting traffic isolation from mobile browsers on iOS and Android when triggered by an Isolate policy action. Enables authentication time extension when the ZPA Private Service Edge cannot reach the ZPA cloud during a network outage (limited availability).
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-09-15
Sep 15, 2023
· release notes
ZDX adds granular Page Fetch Time metrics for Advanced Plus users and ZDX Autosense support for Webex Call Quality onboarding.
Adds granular breakdown of Page Fetch Time individual time metrics to the user details page for Advanced Plus users Adds automated Cloud Path probe generation via ZDX Autosense when onboarding a Webex Call Quality tenant
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-15
Sep 15, 2023
· release notes
ZIA adds EDM with no primary keys, Slack Canvas scanning, NDC dictionaries, VSE support tunnels, and GDrive/Gmail instances.
Adds EDM with No Primary Keys option to the DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Advanced Settings page in the Admin Portal Extends SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP and Malware Detection policies to scan files and messages in Slack Canvas Adds new predefined National Drug Code (NDC) DLP dictionaries: NDC Number (Package) and NDC Number (Product) with an Action option Updates the /dlpDictionaries API endpoint to support the predefinedCountActionType request field Extends Cloud Application Instances feature to GDrive and Gmail applications
+1 more
show less
Adds a Support Information section to the Virtual Service Edge configuration allowing Zscaler-initiated support tunnels
6 details in Everything
Client Connector — Release Upgrade Summary (2023) — 2023-09-15
Sep 15, 2023
· release notes
Zscaler Client Connector adds Dynamic Service Edge Threshold Rank config and macOS bypass via transparent proxy system extension
Allows admins to configure the Threshold Rank for Dynamic ZIA/ ZPA Service Edge Assignment in Forwarding Profile (1-5) Supports bypassing applications using the transparent proxy system extension based on the defined process name for macOS
2 details in Everything
Risk360 — Release Upgrade Summary (2023) — 2023-09-15
Sep 15, 2023
· release notes
Risk360 adds admin portal audit logging and SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. authentication support
Records login name and IP address for every user in the Risk360 Admin Portal, accessible via About Audit Logs Adds SAML authentication support for Risk360 admins, allowing configuration with providers like Okta via the SAML Configuration Guide for Okta
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-14
Sep 14, 2023
· release notes
Adds bypass ZPA during reauthentication option for application segments via UI and API.
Exposes the same bypass option via the Zscaler cloud service API
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-11
Sep 11, 2023
· release notes
Private Access adds logged match details for malicious strings in AppProtection logs.
Logs show if malicious strings are present and display the matched malicious strings in the App Connector AppProtection log Enhancements
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-09-08
Sep 8, 2023
· release notes
ZDX adds option to onboard Zoom QSS tenant for call quality monitoring.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-08
Sep 8, 2023
· release notes
ZIA adds granular GitHub actions in Cloud App Control, domain profiles for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , new NDC dictionaries, Virtual Service Edge support tunnels, and API endpoint updates.
Adds Creating , Editing , Sharing , Commenting , and Reacting action options for the GitHub application in the Add System & Development Rule window of Cloud Application Control Policy Adds Administration > Domain Profiles UI path and support for domain profiles in SaaS Security API DLP rules to remove external collaborators from file share apps Adds new predefined NDC Number (Package) and NDC Number (Product) DLP dictionaries with configurable match action evaluation Adds Zscaler Initiated On-Demand Support Tunnel and Establish Support Tunnel options in the Virtual Service Edge support tunnel feature Updates the /dlpDictionaries API endpoint to accept predefinedCountActionType in the request body for Names dictionaries
5 details in Everything
Client Connector — Release Upgrade Summary (2023) — 2023-09-08
Sep 8, 2023
· release notes
Adds Threshold Rank configuration for Dynamic Service Edge Assignment and macOS transparent proxy app bypass capabilities in Zscaler Client Connector 3.24.1.
Allows admins to configure the Threshold Rank for the Dynamic ZIA Service Edge Assignment and the Dynamic ZPA Service Edge Assignment in Forwarding Profile by selecting a value from 1 to 5 Supports bypassing applications using the transparent proxy system extension based on the defined process name for macOS
2 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the certificate download function from a cloud-based content delivery network content delivery network A content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. (CDN CDN A content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. )
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-09-05
Sep 5, 2023
· release notes
Support for 50k Application Segments on Cloud & Branch Connector.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-05
Sep 5, 2023
· release notes
ZPA enforces unique FQDNs across Private Access, Privileged Remote Access, and Browser Access portals.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-04
Sep 4, 2023
· release notes
ZIA adds Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incidents to Workflow Automation, new Auto Close template, resolution labels, and local timezone display for incidents.
Endpoint DLP incidents are now displayed in the Incidents page and Incident Detail pages within Workflow Automation, allowing remediation via existing actions or predefined workflowsThe new Auto Close Data Loss Protection Incident With Resolution Label Workflow template is available to automatically close incidents using a specified resolution label Data protection incidents (DLP, Saas Security API , and Endpoint DLP ) are now displayed in the user's local time zone instead of GMT (UTC) on the Incidents page The Close Incident action now supports adding a resolution label when associating it with a ticket closure on both the Incidents page and Incident Detail page The Incident Details page includes Next Incident and Previous Incident icons for navigation between incidents in the current list
+1 more
show less
The time range field on the Incidents page now includes a Current Day option
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The Auto Close Data Protection Incident Workflow template has been removed and replaced by Auto Close Data Loss Protection Incident With Resolution Label
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-09-01
Sep 1, 2023
· release notes
ZIA adds DGA domain blocking, Slack/Box/OneDrive/SharePoint quarantine options, and geo-lookup API endpoints.
Adds Deployment Status field (values: In Production , Trial ) to the Virtual Service Edge configuration UI Adds Domain Generation Algorithm (DGA) Domains filter option under Advanced Threat Category in Web, Firewall, and Mobile Insights Logs Adds API endpoints GET /region/byGeoCoordinates, GET /region/byIPAddress/{ip}, and GET /region/search to the Cloud Service API for geo-lookups Adds DGA domain blocking capability within Advanced Threat Protection, DNS Control, and IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control policies Adds scanning schedule configuration (manual or automatic) for Source Code Repository applications in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Scan Configuration
+4 more
show less
Adds new Scanned Repositories and Unscanned Repository tabs to the SaaS Assets Report Adds quarantine capability for sensitive content in Slack with configurable tombstone messages via SaaS Security API DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Policy Adds quarantine capability to user root folders in Box, OneDrive, and SharePoint with configurable tombstone templates via SaaS Security API DLP Policy Adds NSS log filtering by quarantine action for SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. integration
9 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-09-01
Sep 1, 2023
· release notes
ZPA removes PRA concurrency limits and enables local provisioning key download.
Removes concurrency restrictions for Privileged Remote Access (PRA) privileged sessions per App Connector Allows downloading App Connector provisioning keys to the local system Allows downloading ZPA Private Service Edge provisioning keys to the local system
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-08-31
Aug 31, 2023
· release notes
Adds ZDX integration with ServiceNow for Root Cause Analysis and Deep Tracing analytics
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-31
Aug 31, 2023
· release notes
ZIA adds Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , new PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries, ZPA traffic inspection, Okta/GitHub integrations, and Cybersecurity Insights page
Adds GET /dlpDictionaries/{dictId}/predefinedIdentifiers endpoint and hierarchicalIdentifiers, hierarchicalDictionary attributes to /dlpDictionaries endpoints for programmatic DLP dictionary management Introduces Endpoint DLP log type in Nanolog Streaming Service (NSS) with new analytics paths: Analytics > Endpoint DLP Insights, Analytics > Endpoint DLP Report, and Dashboard > Endpoint DLP Adds predefined forwarding rule ZIA Inspected ZPA Apps on Policy > Forwarding Control and predefined Auto ZPA Gateway on Administration > Zscaler Private Access Gateway for inspecting Microtunnel traffic Enables Okta and GitHub integration with 3rd-Party App Governance via dedicated admin portal connectivity Adds Okta as SAML IdP support for authenticating to the 3rd-Party App Governance Admin Portal
+3 more
show less
Introduces new Cloud App Category AI & ML Applications in Policy > URL & Cloud App Control > Cloud App Control Policy Adds Cybersecurity Insights page at Analytics > Cybersecurity Insights providing unified visibility across ATP, Sandbox, Firewall, and Isolation Enables flattened PDF and sandbox-scanned file options for downloads in ZIA isolation profiles
8 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-08-31
Aug 31, 2023
· release notes
Client Connector 4.3.500 adds ZPA latency-based server config, Self Service feature, and configurable posture check intervals.
Adds support for latency-based server configuration for Zscaler Private Access (ZPA) forwarding profiles Includes the new Self Service feature allowing users to resolve device issues independently Supports configurable posture check intervals via Device Posture Profiles
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-31
Aug 31, 2023
· release notes
Adds session recording for Privileged Remote Access (PRA) via privileged capabilities policies.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-30
Aug 30, 2023
· release notes
ZIA adds Real-Time Risk Score for User Risk Report and expands Sandbox Submission API file size limit to 400 MB
Adds Recent Risk Increases section to the User Risk Report Overview in the ZIA Admin Portal, showing trends when real-time scoring is active. Enables viewing recent risk increases in the User Risk Report by toggling the real-time risk score option in Advanced Settings (Administration > Advanced Settings). Increases the maximum file size supported for inspection via the Sandbox Submission API to 400 MB for known and unknown files.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-30
Aug 30, 2023
· release notes
ZPA adds ZIA traffic forwarding for isolation profiles, Microtunnel inspection via API, and User Risk Scores in access policies.
Adds Forwarding Traffic from ZPA Profiles to ZIA as a configurable option on isolation profiles to route non-Microtunnel web traffic through ZIA instead of the public internet. Enables inspection of Microtunnel application segment traffic using Zscaler Internet Access (ZIA) via the ZPA cloud service API. Adds User Risk Scores as a new criteria type in access policy rules, allowing view, edit, and override capabilities for scores and expiration dates to enhance role-based access control role-based access control Role-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. .
3 details in Everything
Client Connector — ZDX Module Release Summary (2023) — 2023-08-29
Aug 29, 2023
· release notes
ZDX Module 3.9 adds admin controls for non-admin log access, location-based probe/alert criteria, and Self Service diagnostics for CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. /Wi-Fi issues
Admins can allow non-admins access to the Zscaler Client Connector logs folder. Supports location groups as a criteria when configuring a new probe or an alert rule. Supports Self Service to improve end user experience by diagnosing and providing recommendations to resolve issues due to high CPU usage and poor Wi-Fi connection to reduce the amount of calls to the IT help desk.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-08-29
Aug 29, 2023
· release notes
ZDX adds Self-Service capabilities for users to resolve CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and Wi-Fi issues via a new dashboard.
Adds Self-Service feature allowing users to self-resolve potential CPU usage and Wi-Fi access issues Adds Self-Service IT Overview dashboard for admins to review notification distribution insights
2 details in Everything
Authentication Service — Release Upgrade Summary (2023) — 2023-08-29
Aug 29, 2023
· release notes
ZSLogin adds MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. enforcement, OIDC OIDC OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. RP support, and a new Entitlements subsystem for service enrollment.
Adds Administration > Authentication Methods configuration to enable and enforce multi-factor authentication multi-factor authentication Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. for ZSLogin users Adds OpenID Connect OpenID Connect OpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. (OIDC) protocol support as a Relying Party (RP) to authenticate against an external OpenID OpenID An open standard for decentralized authentication that lets a user prove their identity to a site via a trusted third-party provider, so tools can delegate login without managing credentials themselves. Provider Adds two advanced settings, Authentication Session for service enrollment and Force Authentication for Private Access Reauthentication , to the Administration > Advanced Settings page
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The existing Zscaler Services page (Administration > Zscaler Services) is no longer available
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-29
Aug 29, 2023
· release notes
ZIA adds WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. protocol support, SSPM SSPM SaaS security posture management, checking hosted applications for risky settings, excessive access and policy violations. It helps teams manage risks across their subscribed applications. for ServiceNow, zero-day zero-day A vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. sandbox, and isolation file options.
Adds WebSocket and WebSocket SSL as selectable protocol types in URL Filtering Rules, Bandwidth Control Rules, and Firewall Filtering Policies, and enables filtering logs by these types in Web/Mobile Insights. Enables SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Management (SSPM) scans for ServiceNow tenants via the SSPM checkbox during tenant onboarding or in existing tenant settings. Adds flattened PDF and sandbox-scanned download options for file transfers in Isolation profiles, allowing admins to control how users receive files from untrusted sources. Allows user enrollment to ZIA Service directly from ZSLogin, with User/Group/Department management and Default Settings pages becoming view-only or unavailable in the ZIA Admin Portal.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! With a ZSLogin subscription, Identity Providers , Authentication Bridges , and Authentication Profiles pages are unavailable in the ZIA Admin Portal; these features have moved to ZSLogin.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-29
Aug 29, 2023
· release notes
Adds ZSLogin integration replacing SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. /SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attributes with User and Group Attributes in ZPA
Policy rule configuration now uses User and Group Attributes instead of SAML and SCIM Attributes criteria Streaming policy on log receivers now uses User and Group Attributes instead of SAML and SCIM Attributes options
2 details in Everything
Private Access (ZPA) — App Connector Release Summary (2023) — 2023-08-28
Aug 28, 2023
· release notes
App Connector 23.219.3 adds AD Protection inspection for Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. /SMB SMB A network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. /LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. and ZDX optimizations
Adds Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (AD) Protection inspection for protocol traffic including Kerberos, SMB, and LDAP Adds AppProtection log enhancements
2 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2023) — 2023-08-28
Aug 28, 2023
· release notes
ZPA v23.219.3 adds User Risk Scores to access policy rules and ZIA inspection for private segments.
Adds user risk scores as a criteria type in access policy rules Enables inspection of an application segment from ZPA using Zscaler Internet Access (ZIA)
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-08-28
Aug 28, 2023
· release notes
Cloud & Branch Connector raises supported ZPA Application Segments limit to 50k
Raises the maximum supported number of ZPA Application Segments from previous limits to 50,000.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-08-25
Aug 25, 2023
· release notes
ZDX adds Location Groups filtering to overview pages, a new Incidents Dashboard for multi-user issues, and shareable ZDX Snapshots for view-only access.
Adds a Location Groups filter to Performance Overview, Applications Overview, and User Overview pages in the ZDX Admin Portal Adds Location Groups filtering option when configuring probing criteria for new probes Adds Location Groups filtering option when configuring alert rules via rule filters Introduces the Incidents Dashboard to display issues affecting multiple users across Wi-Fi, Last Mile ISP, Zscaler Data Centers, and Application Adds ZDX Snapshot feature generating shareable view-only URLs for user details pages
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-25
Aug 25, 2023
· release notes
ZIA adds Endpoint DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Internet Traffic Capture to S3, WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. protocol support, Cybersecurity Insights view, and new API endpoints.
Adds GET /dlpDictionaries/{dictId}/predefinedIdentifiers, hierarchicalIdentifiers, and hierarchicalDictionary attributes to /dlpDictionaries in the Cloud Service API Adds GET /region/byGeoCoordinates, GET /region/byIPAddress/{ip}, and GET /region/search endpoints to the Cloud Service API Adds Endpoint Data Loss Prevention with new logs accessible via Analytics > Endpoint DLP Insights > Logs and a new Endpoint DLP log type for Nanolog Streaming Service (NSS) Adds Traffic Capture settings page at Administration > Traffic Capture and allows storing PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. files in Amazon S3 Adds WebSocket and WebSocket SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. as protocol types for URL Filtering, Bandwidth Control, and Firewall Filtering rules
+6 more
show less
Adds AI & ML Applications category to Cloud App Control Policy Adds Cybersecurity Insights page (Analytics > Cybersecurity Insights) for unified visibility across ATP, Sandbox, Firewall, and Isolation Adds DGA Domains option under the Advanced Threat Category filter in Web, Firewall, and Mobile Insights Logs Adds Quarantine to User Root Folder support for Box, OneDrive, and SharePoint in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP Policy with tombstone template selection Adds Quarantine of sensitive content in Slack via SaaS Security API Control policy with customizable tombstone message Adds Deployment Status field (In Production, Trial) to the Add Virtual Service Edge window
11 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-21
Aug 21, 2023
· release notes
ZIA adds POST endpoints to export Shadow IT Report data via Cloud Service API
Adds POST /shadowIT/applications/export endpoint to export Shadow IT application reports Adds POST /shadowIT/applications/{entity}/exportCsv endpoint for CSV export of specific Shadow IT entities
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-08-18
Aug 18, 2023
· release notes
ZDX adds system-generated ISP/DNS reports, bandwidth tests in Deep Tracing, label management, and ZDX Autosense for Zoom.
Adds Last Mile ISP Performance and DNS Performance as new system-generated reports in the ZDX Admin Portal Allows selecting a bandwidth test when starting a Deep Tracing Session on a user’s device Enables managing labels and reviewing label details via the Labels page in the admin console Introduces ZDX Autosense to dynamically detect Zoom traffic IPs/ports and create automated Cloud Path probes for Zoom Call Quality tenants
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-18
Aug 18, 2023
· release notes
ZIA adds WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. protocol support, DGA blocking, new API endpoints, and Cybersecurity Insights page.
└──▷ USE IT
Retrieve identifiers for a specific DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary via API.
api
copy
GET /dlpDictionaries/{dictId}/predefinedIdentifiers
Adds WebSocket and WebSocket SSL as selectable protocol types in URL Filtering Rules, Bandwidth Control Rules, and firewall network application criteria, with filtering support in Web and Mobile Insights logs. Adds DLP support for Google Drive Labels when creating SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP policy rules. Adds new predefined DLP dictionaries: Credentials and Secrets , Driver's License (United States), and Passport Numbers (European Union) with sub-dictionary selection. Adds GET /dlpDictionaries/{dictId}/predefinedIdentifiers endpoint to retrieve identifiers for newly introduced DLP dictionaries. Adds hierarchicalIdentifiers and hierarchicalDictionary attributes to /dlpDictionaries endpoints.
+8 more
show less
Adds option to block domains suspected of being generated by Domain Generation Algorithms (DGA) in Advanced Threat Protection Policy. Adds Domain Generation Algorithm (DGA) Domains filter under the Advanced Threat Category in Web, Firewall, and Mobile Insights Logs. Enables blocking of DGA domains via DNS Control and IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control policies. Introduces new Cybersecurity Insights page at Analytics > Cybersecurity Insights for unified visibility into threats from ATP, Sandbox, Firewall, and Isolation. Adds AI & ML Applications cloud application category to Cloud App Control Policy. Adds Source IP Groups criterion to SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Rules. Adds In Production and Trial values to Deployment Status field in Add Virtual Service Edge window. Adds new geographic region API endpoints: GET /region/byGeoCoordinates, GET /region/byIPAddress/{ip}, and GET /region/search.
13 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-11
Aug 11, 2023
· release notes
ZIA introduces DNS Gateway with new protocol actions, Custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signatures, source-country firewall rules, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Index privilege drop, and Workflow Automation API/Teams/Jira i
POST /incidents/{dlpIncidentId}/incident-groups/search endpoint allows filtering DLP incident groups via the Workflow Automation API.Workflow Automation integrates with Microsoft Teams to deliver incident notifications (user, escalation, digest) as messages instead of emails. Workflow Automation integrates with Jira Software to create and associate Jira tickets directly from the Incident Details page during remediation. New Notify Owner and Escalate to Manager workflow template sends user notification and manager-only escalation. Custom Signature Rules can be created using Snort syntax under Administration > Custom IPS > Custom Signature Rules.
+22 more
show less
Custom Threat Categories can be defined under Administration > Custom IPS > Threat Categories and associated with custom signature rules. Firewall filtering rules now support the Countries field on the Source IP tab to allow/block traffic by source country geolocation. /firewallFilteringRules API endpoints now include sourceCountries and excludeSrcCountries fields for source-country policy support.New Source Country filter and column are added to Firewall Insights Logs; existing Country /Server Country renamed to Dest Country . %s{srcip_country} field is available in NSS Feed Output Format for Firewall logs.DNS Gateway feature enables DNS high availability and protocol translation (DoH DoH DNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. , TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. ) via Administration > Proxies & Gateways > DNS Gateways. DNS Control Policy rules add Redirect Request Using DoH, Redirect Request Using TCP , Redirect Request Using UDP , and Redirect Request & Keep Sender Protocol actions. NAT Control rules add Redirect Request Using DoH and Redirect DNS & Keep Sender Protocol actions with a new DNS Gateway field. Redirect Request action is deprecated in DNS Control policy rules.New fields added to DNS Insights Logs: DNS Gateway Flags , Resolver Gateway , HTTP Status Code , Server Protocol . NSS Feeds for DNS logs now support %s{dnsgw_slot}, %s{dnsgw_srv_proto}, %s{dnsgw_flags}, and %s{http_code} fields. AI Instant Verdict can be enabled in Sandbox Policy to block files with threat score > 90 or quarantine files with score 70-90. SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Application Tenants can now be deleted directly from the About SaaS Application Tenants page table.Source IP Groups criterion is added to the Add SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Rule window.DLP Index Tool service can be configured to run without elevated privileges. SaaS Security API DLP policy rules support Google Drive Labels for classification. Watermarking capability allows admins to display user ID, date/timestamp, and custom message in isolation profiles. Isolation banners can now persist throughout the session via ZIA isolation profile settings. Persistent isolation URL bar option is available per ZIA isolation profile. Sandbox BAUI Report includes a new Malware Configuration Extraction tile. Insert X-Authenticated-User and Base64 encode XAU fields are added to the Add Proxy window for third-party proxy chaining.Tenant Profiles now support Zoho Login Services.
27 details in Everything
└──▷ BREAKING ON UPGRADE
! In DNS Control policy rules, the Redirect Request action has been deprecated in favor of new protocol-based actions; existing rules using this action may be automatically split or modified during migration to ensure backward compatibility.
Client Connector — Release Upgrade Summary (2023) — 2023-08-11
Aug 11, 2023
· release notes
Zscaler Client Connector Portal 3.24 adds multi-cloud ZPA integration, Linux app bypasses, and configurable posture check intervals.
Adds support for integrating multiple Zscaler Private Access (ZPA) clouds with the Zscaler Client Connector Portal Adds support for predefined application bypasses for Linux Supports configurable posture check intervals to define how often Zscaler Client Connector reevaluates device posture Integrates ZIdentity with Zscaler Client Connector and the Zscaler Client Connector Portal to manage user and device information in one place
4 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-08-11
Aug 11, 2023
· release notes
Client Connector 4.1.0.152 adds macOS Sonoma support and fixes reauth/firewall issues
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-07
Aug 7, 2023
· release notes
ZPA introduces AD Protection capabilities and API exposure in this service update.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-08-04
Aug 4, 2023
· release notes
ZIA release adds DNS Gateway support, source country firewall rules, custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signatures, and AI sandbox verdicts.
Adds Source IP Groups criterion to the Add SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Rule window for rule creation Adds sourceCountries and excludeSrcCountries fields to the /firewallFilteringRules API endpoint Adds Countries field on the Source IP tab of the firewall filtering rule for geolocation-based allow/block actions Adds new filter and column, Source Country , to Firewall Insights Logs Adds %s{srcip_country} field for NSS feeds when adding a Firewall logs feed
+13 more
show less
Enables creation of custom signature rules using Snort syntax under Administration > Custom IPS > Custom Signature Rules Adds support for defining custom threat categories under Administration > Custom IPS > Threat Categories Adds Redirect Request Using DoH, Redirect Request Using TCP , Redirect Request Using UDP , and Redirect Request & Keep Sender Protocol actions to DNS Control policy rules Adds Redirect Request Using DoH and Redirect DNS & Keep Sender Protocol actions to NAT Control rules Enables configuration of DNS Gateways under Administration > Proxies & Gateways > DNS Gateways for high availability and protocol translation Adds DNS Gateway Flags , Resolver Gateway , HTTP Status Code , and Server Protocol fields to DNS Insights Logs Adds %s{dnsgw_slot}, %s{dnsgw_srv_proto}, %s{dnsgw_flags}, and %s{http_code} fields for NSS feeds when adding a DNS logs feed Enables AI Instant Verdict in Sandbox Policy to analyze unknown files in real time and assign threat scores Adds Insert X-Authenticated-User and Base64 encode XAU fields to the Add Proxy window for third-party proxy chaining Adds capability to delete SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application tenants directly from the About SaaS Application Tenants page table Enables persisting isolation banners and URL bars per ZIA isolation profile Adds watermarking capability for isolation to display user ID, date/timestamp, or custom message in isolated sessions Increases the limit for SSL inspection policy rules to 255 via Updates to Ranges & Limitations
18 details in Everything
Client Connector — Release Upgrade Summary (2023) — 2023-08-04
Aug 4, 2023
· release notes
Zscaler Client Connector Portal 3.24 adds ZPA multi-cloud integration, Linux app bypasses, and configurable posture check intervals.
Supports integrating multiple Zscaler Private Access (ZPA) clouds with the Zscaler Client Connector Portal Adds support for predefined application bypasses for Linux Integrates ZIdentity with Zscaler Client Connector and the Zscaler Client Connector Portal to manage both user and device information in one place Supports configurable posture check intervals
4 details in Everything
Private Access (ZPA) — App Connector Release Summary (2023) — 2023-08-01
Aug 1, 2023
· release notes
App Connector 23.191.4 adds OS trusted CA bundle support, wildcard CNAME CNAME A DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. resolution, and new CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. starvation/control disconnect events.
App Connector 23.191.4 now updates components using the full list of OS trusted certificate authority (CA) bundlesApp Connector 23.191.4 triggers a new event on CPU starvation, viewable in Viewing and Managing Events Diagnostics App Connector 23.191.4 triggers a new event when the control connection disconnectsApp Connector 23.191.4 supports configuration of alternative cloud domains via Alternative Cloud Domain
4 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2023) — 2023-08-01
Aug 1, 2023
· release notes
ZPA 23.191.2 adds reevaluation for posture profile changes in Adaptive Access
Risk360 — Release Upgrade Summary (2023) — 2023-08-01
Aug 1, 2023
· release notes
Zscaler launches Risk360 platform for measuring and remediation of risk from Zscaler environment data.
Enables access to the Risk360 platform via zscalerrisk.net for holistic risk management Provides real-time risk metrics and quantification across organization security data Adds financial, industry standards, and peer perspective views on organizational risk
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-08-01
Aug 1, 2023
· release notes
ZPA adds Microtenant delegation APIs, geofencing support, and server-initiated remote admin workflows in the August 2023 release.
Adds Microtenant administration via the ZPA Admin Portal for delegated responsibility scoped by authentication domain Adds customer-facing ZPA API endpoints for managing Microtenants, moving application segments between Default tenants and Microtenants, and sharing segments between Microtenants Adds an endpoint to retrieve all configured isolation profiles and CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. APIs for isolation policy use cases via the policy-set-controller in the ZPA API Portal Enables clients to connect or remain connected to ZPA Public Service Edges within a geofence-enforced region Adds new events and notifications for App Connector connectivity/upgrade metrics when control connections disconnect, plus an event for App Connector CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. starvation
+2 more
show less
Enhances reevaluation of access when posture profiles change Supports server-initiated remote administration workflows (remote assistance, troubleshooting, software distribution) using FQDN or IP-based connectivity
7 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-07-28
Jul 28, 2023
· release notes
ZDX adds External Proxy traceroute scenarios in Cloud Path and new Process Inventory monitoring with configurable CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. thresholds.
Adds support for traceroute scenarios in the Cloud Path when an External Proxy is detected Adds Process Inventory feature to monitor processes impacting user devices, displaying top processes every five minutes based on configured CPU usage thresholds
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-07-28
Jul 28, 2023
· release notes
ZIA adds AI Instant Verdict for sandbox files, source-country firewall rules, DNS Gateway support, and custom auth timeout profiles
Adds AI Instant Verdict feature to Sandbox policies to analyze unknown files in real time based on a threat score. Adds sourceCountries and excludeSrcCountries fields to the /firewallFilteringRules API endpoints for source-country based policies. Adds a new Countries field on the Source IP tab of firewall filtering rules to allow or block traffic by origin country. Adds Source Country filter and column, and renames existing Country filter/column to Dest Country in Firewall Insights Logs. Makes %s{srcip_country} field available for NSS feeds outputting Firewall logs.
+15 more
show less
Adds DNS Gateway object under Administration > Proxies & Gateways > DNS Gateways to enable DNS high availability and protocol translation. Adds Redirect Request Using DoH, Redirect Request Using TCP , Redirect Request Using UDP , and Redirect Request & Keep Sender Protocol actions to DNS Control policy rules. Adds Redirect Request Using DoH and Redirect DNS & Keep Sender Protocol actions to NAT Control rules for DNS redirection via a secured DNS Gateway. Adds new fields DNS Gateway Flags , Resolver Gateway , HTTP Status Code , and Server Protocol to DNS Insights Logs. Makes %s{dnsgw_slot}, %s{dnsgw_srv_proto}, %s{dnsgw_flags}, and %s{http_code} fields available for NSS feeds outputting DNS logs. Adds Authentication Profiles tab to Administration > Authentication Settings > Authentication Profiles page. Adds Authentication Profile field to the Edit Location window on the Location Management page. Adds option to persist isolation banners throughout the duration of an isolation session per ZIA isolation profile. Adds option to enable a persistent isolation URL bar per ZIA isolation profile. Adds watermarking capability for isolation, allowing display of user ID, date/timestamp, and custom message per isolation profile. Adds new Malware Configuration Extraction tile in the Sandbox BAUI Report. Displays undiscovered cloud applications on the Shadow IT Reports page and allows viewing their security attributes on the Application Information page. Adds Insert X-Authenticated-User and Base64 encode XAU fields to the Add Proxy window for Third-Party Proxy Chaining. Allows enabling or disabling Client Connector notifications for web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rules when violations occur. Raises the limit for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policy rules to 255 per the Ranges & Limitations section.
20 details in Everything
└──▷ BREAKING ON UPGRADE
! The Country filter and column in Firewall Insights Logs are renamed to Dest Country .! In DNS Control policy rules, the Redirect Request action has been deprecated in favor of the new protocol-based actions (Redirect Request Using DoH, etc.).
Client Connector — ZDX Module Release Summary (2023) — 2023-07-27
Jul 27, 2023
· release notes
ZDX Module 3.8 adds autosense probes, bandwidth testing, and external proxy/DNAT support
Adds ZDX Autosense probes that dynamically detect and probe endpoints Adds bandwidth testing for ZDX Deep Tracing sessions to analyze network health Adds support for Destination Network Address Translation (DNAT) in the ZDX Cloud Path Adds support for external proxy bypasses in ZDX
4 details in Everything
Deception — Release Upgrade Summary (2023) — 2023-07-27
Jul 27, 2023
· release notes
Zscaler Deception adds Apple Silicon agent support, Azure/AWS cloud decoy integrations, ZCC user policy criteria, and safe event retention.
Adds Apple Silicon support for the Landmine Agent and Agentless installers on Mac computers. Enables using Zscaler Client Connector users as criteria in Landmine Policies . Integrates Microsoft Azure and Amazon Web Services (AWS) via Cloud Deception to deploy platform-specific decoy resources such as AWS IAM AWS IAM AWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. , S3, RDS, ECR ECR Amazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure. , DynamoDB, VM Images and Azure Users, Service Principals, Managed Identities, App Services, Storage Account Containers/Shares, Key Vaults, ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Templates, Container Registries, VM Images. Configures lures for cloud decoys via Landmine Policies including Cloud Lures , Browser Lures , Session Lures , and File Decoys .
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The existing AWS Decoys feature (Deceive > AWS Decoys) is deprecated; all existing AWS IAM IAM Identity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. decoys and AWS S3 decoys will no longer work and require manual migration to the new Cloud Deception with AWS.
Client Connector — Client Connector App Release Summary (2023) — 2023-07-27
Jul 27, 2023
· release notes
Zscaler Client Connector 4.3 adds ZDX Autosense probes, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. integration, HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files, and captive portal detection.
Supports ZDX Autosense probes by dynamically detecting and probing endpoints Supports excluding traffic from applications based on Application Identity attributes Adds support for downloading the default PAC file using HTTPS Allows administrators to bypass IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. traffic during authentication Adds a default bypass for partner tenants when the partner is on a different cloud
+4 more
show less
Provides the ability to configure the synthetic IP range used by ZPA Supports integration of Endpoint Data Loss Prevention service with Zscaler Client Connector Allows non-admin users access to the Client Connector logs folder Supports creation of custom app bypass rules for packet tunnel exclude filters
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-07-24
Jul 24, 2023
· release notes
Workflow Automation adds Slack notifications and ServiceNow ticket creation.
Workflow Automation can deliver incident notifications via Slack instead of email Incident Details page now includes a Ticket section to create and view ServiceNow tickets for incidents Auto Create Tickets workflow template is available to automatically generate tickets in integrated ticketing applications
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-07-21
Jul 21, 2023
· release notes
ZDX adds dynamic alerting with ZDX Score or Drop parameters for network and application rule types.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-07-21
Jul 21, 2023
· release notes
ZIA adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, custom auth timeouts, MIP labels for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and GitLab SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. integration.
Adds Authentication Profiles tab to Authentication Settings page for creating custom authentication timeout profiles assignable per location Adds ipv6Enabled and ipv6Dns64Prefix parameters to Location Management resources (e.g., POST /locations) to enable IPv6 support Adds new API endpoints GET /ipv6config, GET /ipv6config/dns64prefix, GET /ipv6config/nat64prefix, GET /ipSourceGroups/ipv6SourceGroups, GET /ipSourceGroups/ipv6SourceGroups/lite, GET /ipDestinationGroups/ipv6DestinationGroups, GET /ipDestinationGroups/ipv6DestinationGroups/lite for IPv6 configuration Adds new parameters srcIpv6Groups and destIpv6Groups to Firewall Policy resources (e.g., POST /firewallFilteringRules) for IPv6 source/destination grouping in firewall rules Adds support for configuring MIP labels in the SaaS Security API Control policy Add DLP Rule window for OneDrive and SharePoint tenants
+2 more
show less
Allows Unicode characters in DLP patterns with updated syntax supporting nested repeats, 256 byte max pattern length, and ?i/?-i case-insensitive tokens Adds new predefined DLP dictionaries for VAT Numbers in Austria, Belgium, France, Germany, Luxembourg, and Netherlands
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The Client IPv6 option is removed from the Web Insights Logs filters and columns.! The field %s{cltipv6} is deprecated and removed from the NSS feed for web logs.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-07-14
Jul 14, 2023
· release notes
ZIA adds GitLab SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenant support, customizable quarantine notifications, Unicode DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. patterns, new event type for NSS feeds, and multiple privacy/filter controls in Workfl
Adds support for configuring GitLab as a SaaS Application Tenant Enables customization of the quarantine notification text on the End User Notifications page (Administration > End User Notifications) Adds Violation as an event type option when configuring NSS Feeds for SaaS Security Logs and Cloud NSS Feeds Supports Unicode characters in DLP patterns, removes base token requirement, allows nested repeats with a 256-byte max, and adds ?i/?-i case-insensitive tokens Adds hide policy details for - remediation owners and hide policy details for - managers/approvers privacy flags in Workflow Automation
+5 more
show less
Adds Modules and Resource filters (API Keys, DLP, Customers, Incident Groups, Integrations, Workflow) to the Audit Logs page in Workflow Automation Extends Cloud Application Instances support to GDrive and Gmail Enables granular Allow/Block actions (Downloading, Sharing, Editing, Inviting, Renaming, Creating, Deleting, Form Sharing) for specific apps in File Sharing rules for Cloud App Control Allows multiple AWS tenants to be onboarded via a single CloudTrail CloudTrail AWS service that records API calls and account activity across an AWS environment, giving cyber tools an audit log to detect anomalous or malicious actions. account for SaaS Application Tenants Supports enabling or disabling Client Connector notifications for web DLP rule violations on the Add DLP Rule page
10 details in Everything
└──▷ BREAKING ON UPGRADE
! The Cyber Risk Report is renamed to Configuration Risk Report
Client Connector — Release Upgrade Summary (2023) — 2023-07-14
Jul 14, 2023
· release notes
Zscaler Client Connector 3.23.1 adds IP/process bypass and ZDX Autosense probes
Enables admins to add IP-based applications and process-based applications to the Application Bypass policy in the UI Adds dynamic detection and probing of endpoints via ZDX Autosense probes
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-07-07
Jul 7, 2023
· release notes
Adds user group filtering to Performance, Applications, and User Overview pages in the ZDX Admin Portal.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-07-07
Jul 7, 2023
· release notes
ZIA adds custom auth timeout profiles, quarantin notification customization, new DPI dictionaries, and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. pattern enhancements.
Adds Authentication Profiles tab to Administration > Authentication Settings for custom authentication timeouts Adds Authentication Profile field to Edit Location window on Location Management page Enables customization of quarantine notifications via the End User Notifications page (Administration > End User Notifications) Adds new predefined DLP dictionaries for VAT Numbers in Austria, Belgium, France, Germany, Luxembourg, and Netherlands Updates Web Insights Logs File Share Activity filter with With File Uploads Only and Without File Uploads activities
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The Cyber Risk Report is renamed to Configuration Risk Report! Web Insights Logs File Share Activity filter no longer supports the existing Upload and View activities
Client Connector — Release Upgrade Summary (2023) — 2023-07-07
Jul 7, 2023
· release notes
Zscaler Client Connector Portal 3.23.1 adds ZDX Autosense probes and IP-based bypass capabilities
Enables admins to add IP-based applications and process-based applications to Application Bypass (renamed from Web Based ) Adds support for ZDX Autosense probes by dynamically detecting and probing the endpoints
2 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-07-05
Jul 5, 2023
· release notes
iOS 1.9.8 adds captive portal detection with browser launch and ZPA Private Service Edge support
Adds captive portal detection with an option to launch the default browser to complete authentication. Adds support for ZPA Private Service Edges on iOS.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-07-05
Jul 5, 2023
· release notes
ZPA adds Policy Reorder as a filterable resource type in Admin Portal Audit Logs
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-30
Jun 30, 2023
· release notes
ZIA adds Cloud Application Tags, Risk Index in Web Insights Logs, and client notifications for Web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest.
Cloud Application Tags tab added to Administration > Labels & Tags and Tags field on Application Information page for grouping cloud applications.Risk Index filter and column added to Web Insights Logs for filtering and viewing risk scores.Match Only option added when configuring DLP Block rules to trigger only when transactions match specified engines. External ID field required when adding AWS S3 as a SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. application tenant via the SaaS Security API.Client Connector notifications can now be enabled or disabled for Web DLP rules violations on the Add DLP Rule page.
+3 more
show less
SharePoint site scan configuration updated to allow automatic scanning of all sites or manual selection via discovered/custom lists. File Type Control and DLP policies gain support for .db, .drv, .one, .dat, .eml, .emlx, .ini, .pcapng, .pcap pcap A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. , .au3, .bgi, .manifest, and .nls file types. Remove and Restore options added as remediation actions for quarantined files in the Incidents section of the SaaS Assets Report.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! New tenants can no longer establish IKEv1 IPSec VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels; contact Zscaler Support to enable.
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-06-30
Jun 30, 2023
· release notes
Cloud & Branch Connector VMs can now be enabled, disabled, or deleted directly from the UI
Adds ability to enable or disable operational status of Cloud and Branch Connector VMs via the Edit Connectors window Adds ability to delete individual Cloud or Branch Connectors using the Delete icon on the Connector Groups pages
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-06-23
Jun 23, 2023
· release notes
Adds download capability for Quarterly Business Review (QBR) reports in the ZDX Admin Portal.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-23
Jun 23, 2023
· release notes
ZIA adds Cloud App Tags, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Match Only block rules, new Workflow Automation API endpoints, and Risk Index in Web Insights
POST /incidents/{dlpIncidentId}/notes endpoint added to Workflow Automation API to add notes or comments about the progress of a DLP incident.GET /incidents/{dlpIncidentId}/evidence endpoint added to retrieve the evidence URL for downloading data that triggered a DLP incident.POST /incidents/search enhanced to filter and search for DLP incidents by their labels.New Match Only option available when configuring DLP Block rules to trigger only when transactions match specified DLP engines. New Cloud Application Tags tab added under Administration > Labels & Tags to logically group cloud applications.
+3 more
show less
Risk Index filter and column added to Web Insights Logs.New options Remove and Restore added as remediation actions in the Incidents section of the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report for file sharing applications. External ID field now required when adding AWS S3 as a SaaS application tenant via the SaaS Security API.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! New tenants of an organization can no longer establish IKEv1 IPSec VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels from vendor products to forward traffic to ZIA; contact Zscaler Support to enable support.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-19
Jun 19, 2023
· release notes
LSS adds ClientCity/City fields for User logs; admin portal blocks compromised passwords; API v2 labels removed.
Adds ClientCity and City log fields to the Log Streaming Service (LSS) for User Activity and User Status log types Improves ZPA Admin Portal to reject passwords found in a compromised password list during creation or update Removes version two (v-2) labels from certificate, enrollment certificate, IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration, posture profile, SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attribute, LSS configuration, and trusted network controllers APIs
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The ConnectorUpTime log field label is renamed to ConnectorStartTime! The HostUpTime log field label is renamed to HostStartTime! The isClientAudit log field label is renamed to clientAuditUpdate! API fields previously labeled with version two (v-2) for certificate, enrollment certificate, IdP configuration, posture profile, SAML attribute, LSS configuration, and trusted network controllers no longer have those labels
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-06-16
Jun 16, 2023
· release notes
Adds system-generated reports in ZDX Admin Portal aggregating user data
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-16
Jun 16, 2023
· release notes
ZIA adds Cloud App Tags UI, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Match Only block rules, NSS Collectors for third-party Shadow IT logs, and new file types to DLP/File Type Control
Adds Administration > Labels & Tags > Cloud Application Tags tab to logically group cloud applications for traffic handling. Adds Tags field to the Application Information page (accessible via Analytics > SaaS Security Report > Applications). Adds Match Only option to DLP block rules to trigger blocks only when transactions match specified engines and no others. Adds NSS Collector server configuration under Administration > Nanolog Streaming Service > NSS Collector Servers for ingesting third-party vendor logs (e.g., Palo Alto Networks) into Shadow IT Reports. Enables new file types in File Type Control and DLP policies: .db, .drv, .one, .dat, .eml, .emlx, .ini, .pcapng, .pcap, .au3, .bgi, .manifest, .nls.
+1 more
show less
Adds Risk Index filter and column to Web Insights Logs.
6 details in Everything
└──▷ BREAKING ON UPGRADE
! New tenants can no longer establish IKEv1 IPSec VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels from vendor products to forward traffic to ZIA; existing connections are not affected, but new ones require IKEv2 IKEv2 The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. or support contact.
Client Connector — Release Upgrade Summary (2023) — 2023-06-16
Jun 16, 2023
· release notes
Zscaler Client Connector 3.23 adds non-admin log access, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. integration, and hardware fingerprint search
Adds configuration to allow non-administrator users access to Zscaler Client Connector log files Supports Endpoint Data Loss Prevention integration with Zscaler Client Connector Supports searching by the hardware fingerprint on the Machine Tunnel page Adds machine tunnel support for device postures: File Path, Registry Key, Firewall, Full Disk Encryption, Domain Joined, and OS Version Adds a configuration that restricts remote packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for administrators only
+1 more
show less
Adds support for latency-based server configuration for ZPA
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-06-16
Jun 16, 2023
· release notes
AWS deployment templates now enforce IMDSv2 and update AMI to ZS6.1.25.0
AWS Deployment Templates for Zscaler Cloud Connector now enforce Instance Metadata Service Version 2 (IMDSv2) by default Zscaler Cloud Connector Amazon Machine Image (AMI) updated to version ZS6.1.25.0 with additional OS Hardening
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-15
Jun 15, 2023
· release notes
The Zscaler Private Access service update enables App Connectors to run on Docker platforms.
Client Connector — Client Connector App Release Summary (2023) — 2023-06-14
Jun 14, 2023
· release notes
Client Connector 1.9.6 adds captive portal user notifications, ZPA Private Service Edges support on iOS, and improved certificate trust fallback
Adds captive portal detection with native UI notification allowing users to launch their default browser to authenticate. Extends Zscaler Private Access (ZPA) coverage to include Private Service Edges on iOS.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-14
Jun 14, 2023
· release notes
ZPA Intelligent App Segmentation adds recommended user lists and attack surface attack surface The exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visualization with new similarity factors.
Intelligent Application Segmentation now provides a list of recommended users for application segments Intelligent Application Segmentation offers a visualization of the reduced attack surface upon accepting recommended segments Intelligent Application Segmentation includes Domain Name Similarity as a recommendation factor Intelligent Application Segmentation includes Co-occurring Applications Similarity as a recommendation factor
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-13
Jun 13, 2023
· release notes
ZIA adds .7Z, password-protected Office file support in Isolation and improves browser-in-browser tab mapping.
Enhanced File Type Support for Isolation allows users to decompress and view .ZIP, .TAR, .7Z, and .RAR files, plus additional Office formats (.PPT, .DOC, .XLS, .CSV, .RTF, .TXT, .ODP, .ODS, .ODT) and Visio. Isolation now supports password-protected Office files by prompting the user for the file-specific password before rendering in the isolation browser. Browser-in-Browser User Experience Mode Update for Isolation simplifies tab mapping so each native browser tab maps to a distinct tab on the isolation browser.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-13
Jun 13, 2023
· release notes
ZPA Isolation adds simplified Browser-in-Browser UX and support for decompressing/viewing compressed and Office file types
Browser-in-Browser User Experience Mode Update for Isolation simplifies the workflow so each tab on the native browser maps to a tab on the isolation browser, preventing multiple tabs from displaying in a single native tab. Enhanced File Type Support for Isolation allows users to decompress and view .ZIP, .TAR, .7Z, and .RAR files, as well as view .PPT, .DOC, .XLS, .CSV, .RTF, .TXT, .ODP, .ODS, and .ODT Office files. Isolation now supports password-protected Office files by prompting the user for the file-specific password to render the content in the isolation browser.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-06-09
Jun 9, 2023
· release notes
ZDX adds ZPA app management and SIPA highlighting in Web Probe Metrics
Adds Configuration > Applications > Top Private Apps section in the Configuration Portal to manage Zscaler Private Access (ZPA) applications directly from ZDX.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-09
Jun 9, 2023
· release notes
ZIA adds custom TLD TLD The rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. categories in policies, custom cloud apps, Okta SSPR, scheduled Shadow IT reports, client connector notifications, and Azure Incident Receiver support.
Custom TLD Categories can now be defined and matched in DNS Control, File Type Control, Firewall Filtering, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Sandbox, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. (with/without content inspection), Forwarding, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policies, and URL FilteringAbility to schedule daily and weekly Shadow IT Report outputs with new filter options, time periods, notes, and policy visibility Custom Cloud Applications category allows admins to add/delete non-predefined apps and create Cloud App Control Policy rules for themOkta is now supported in SaaS Security Posture Control policy and the SaaS Security Posture Report for tenant configurationClient Connector notifications can be enabled/disabled on violations in Web DLP Rules (Add DLP Rule page)
+2 more
show less
Cloud Application field added to the URL Lookup window (Help > URL Lookup) showing associated category and app nameSupport for deploying Zscaler Incident Receiver on Azure VMs using a SAS token-based VHD deployment
7 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-06-09
Jun 9, 2023
· release notes
Zscaler Client Connector 4.1 adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. inclusions/exclusions, PcapNG support, partner ZPA tenant function, and split-tunnel VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection on macOS
Supports the PcapNG file format for packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. Adds a configurable option to force ZPA authentication after sleep/hibernation or network IP change Supports detecting split-tunnel VPN alongside full-tunnel Trusted Network detection Adds External Device ID value in Device Details Supports Partner Zscaler Private Access (ZPA) Tenant function to allow or remove access to partner ZPA resources
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes support of legacy cipher suites from Zscaler Client Connector TLS connections
Client Connector — Client Connector App Release Summary (2023) — 2023-06-07
Jun 7, 2023
· release notes
Client Connector 3.9.0.95 adds DigiCert Global Root G2 public CA support for macOS
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-07
Jun 7, 2023
· release notes
ZPA adds Browser Protection profiles, policies, and dashboard for monitoring browser access sessions.
Introduces Browser Protection profiles to set attributes used to create fingerprints for browser access sessions Adds the ability to create Browser Protection policies to monitor users and fingerprint their browser access sessions Provides a new Browser Protection Dashboard and updates the Clientless Access Diagnostics page to view results for monitored users and inspected sessions
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-06-02
Jun 2, 2023
· release notes
ZIA adds custom TLD TLD The rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. categories in policies, bypassed traffic log fields, and Azure Incident Receiver deployment.
Adds Custom TLD Categories to DNS, Firewall, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. , Sandbox, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Forwarding, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection, and URL Filtering policies Adds new filters and columns (Bypassed Transaction Event Time, Flow Type, Bypassed Transaction; Bypassed Session Event Time, Flow Type, Bypassed Session) to Web and Firewall Insights Logs Adds NSS feed fields %d{bypassed_traffic}, %s{bypassed_etime}, %s{flow_type} for Web logs and %d{bypassed_session}, %s{bypass_etime}, %s{flow_type} for Firewall logs Enables adding or deleting custom cloud applications in the Custom Cloud Applications category on Administration > Cloud Applications page Adds Cloud Application field to the URL Lookup window (Help > URL Lookup)
+1 more
show less
Adds Azure VM deployment support for Zscaler Incident Receiver using a VHD SAS token
6 details in Everything
└──▷ BREAKING ON UPGRADE
! Default notification and survey templates in Workflow Automation are now view-only; they can no longer be modified by admins.
Client Connector — Release Upgrade Summary (2023) — 2023-06-02
Jun 2, 2023
· release notes
Client Connector Portal 3.23 adds EDP integration, Z-Tunnel 2.0 block config, and latency-based ZPA server selection.
Adds the Forwarding Profile column to the App Profile page in the portal UI. Adds configuration to allow non-administrator users access to Zscaler Client Connector log files. Adds support for Endpoint Data Loss Prevention (EDP) integration with Zscaler Client Connector via App Profiles. Adds configuring the Block Unreachable Domain Traffic for Z-Tunnel 2.0 within Forwarding Profiles. Adds machine tunnel support for device postures: File Path, Registry Key, Firewall, Full Disk Encryption, Domain Joined, and OS Version.
+2 more
show less
Adds support for latency-based server configuration for ZPA. Adds a configuration that restricts remote packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. for administrators only.
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-06-02
Jun 2, 2023
· release notes
ZPA adds clipboard PRA, country code policy criteria, VNC file transfer, and supporting files status to Private Service Edges
Enables copy-paste text between local devices and privileged consoles via Privileged Remote Access (PRA) using a privileged capabilities policy Adds country codes as a criteria option in access policies to allow or block users based on IP location Supports File Transfer for VNC protocol in Privileged Remote Access (PRA) privileged consoles Displays upgrade status of supporting files mapping the public IP of a ZPA Private Service Edge to its registered country
4 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2023) — 2023-05-31
May 31, 2023
· release notes
ZPA 23.120.1 adds support for large number of applications and updates Branch/Cloud Connectors.
Supports a large number of applications in ZPA Private Service Edge.
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! Requires admins to change the default password.
Deception — Release Upgrade Summary (2023) — 2023-05-31
May 31, 2023
· release notes
Zscaler Deception adds ZIA containment integration, Sumo Logic SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. support, UI renames, landmine agent validation, and license model changes for ZCC-integrated landmines.
Adds integration with Zscaler Internet Access (ZIA) to contain and isolate users interacting with landmine decoys by blocking internet access. Adds Security Information and Event Management (SIEM) integration with Sumo Logic for real-time log transmission. Updates UI on the Containment page: the Blocked IPs/Hostnames column is renamed to Blocked Identities. Updates UI on the Rules and Safe Processes pages: the Status column is renamed to Type. Moves the Deception Strategy page to Miragemaker > Strategy Builder > Deception Strategy in the Admin Portal.
+2 more
show less
Adds validation for Landmine Agent Service Name to prevent configuration conflicts with default services. Changes license calculation for Zscaler Client Connector-integrated landmines to per-user logged into Zscaler Client Connector.
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-31
May 31, 2023
· release notes
ZPA Manager update for Branch Connector support; PSE password reset requirement and new app download limits.
Manager software updates to support Zscaler Branch Connector via Red Hat Enterprise Linux 7 base.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-30
May 30, 2023
· release notes
ZPA Admin Portal now manages Browser Isolation profiles and certificates
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-05-26
May 26, 2023
· release notes
ZDX release introduces ISP filtering capabilities on key dashboard pages and allows granular time-based duration settings for Admin Access roles.
Adds ISP filter to Performance Overview, Applications Overview, and User Overview pages in the ZDX Admin Portal Adds time duration selection for Help Desk roles in the Add ZDX Role dialog window
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-26
May 26, 2023
· release notes
ZIA adds Okta support for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. posture, custom TLD TLD The rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. categories in policies, UEBA alert rules for inline/API channels, and bypassed traffic logs.
Adds support for Okta as a configurable tenant and application in the SaaS Security Posture Control policy and report Adds Custom TLD Categories that can match traffic to specific TLDs in DNS, File Type, Firewall Filtering, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. , Sandbox, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Forwarding, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection, and URL Filtering policies Introduces UEBA Alert rules for the inline channel, with configurable trigger criteria and dynamic actions (Alert, Place user in a group, Trigger Multi-Factor Authentication) Adds new filter options and time periods to the Enhanced Shadow IT report, including the ability to schedule daily/weekly reports, add notes, and view applied policies Adds custom cloud applications to the Cloud Applications page for use in Cloud App Control and DLP policies, with support for custom access rules
+4 more
show less
Adds new columns and filters (Bypassed Transaction Event Time, Flow Type, Bypassed Transaction) to Web Insights Logs and Bypassed Session Event Time, Flow Type, Bypassed Session to Firewall Insights Logs Adds NSS feed fields for bypassed traffic: %d{bypassed_traffic}, %s{bypassed_etime}, %s{flow_type} for web logs and %d{bypassed_session}, %s{bypass_etime}, %s{flow_type} for firewall logs Adds the Cloud Application field to the URL Lookup window (Help > URL Lookup) to show associated cloud application category and name Enables deployment of the Zscaler Incident Receiver on Azure VMs using a VHD shared access signature (SAS) token
9 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-05-26
May 26, 2023
· release notes
Added automatic HTTP health checks for tunnels and configurable ICMP support for application segments.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-05-19
May 19, 2023
· release notes
ZDX adds Webex Call Quality monitoring for meetings in configured tenants.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-19
May 19, 2023
· release notes
ZIA adds inline UEBA alert channels with MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. trigger, Cascade to URL Filtering in Cloud App Control, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. dictionaries and file types, and Quarantine Tombstone Templat
Adds Trigger Multi-Factor Authentication dynamic action for Inline UEBA Alert Channels to force step-up authentication. Adds new UEBA alert rules for the inline channel on zia.zscaler.net and zscloud.net with configurable trigger criteria. Adds Cascade to URL Filtering option to Cloud App Control policy rule pages on zscalertwo.net and zscalerthree.net. Adds support for Tax Identification Number PII dictionaries in new predefined DLP sets (Austria, Belgium, Denmark, France, Germany, Hungary, Luxembourg, New Zealand, Portugal, Sweden). Adds File Type Control and DLP support for AutoCAD (.dxf), Integrated Circuit (.gds, .gds2, .oas, .oasis), and Tableau file types.
+2 more
show less
Adds Multi-alphanumeric Identity data type option for fields in Exact Data Match (EDM) templates. Adds Quarantine Tombstone Template action for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP and Malware policies on zia.zscaler.net and zscloud.net.
7 details in Everything
└──▷ BREAKING ON UPGRADE
! SaaS Security alert details moved from the SaaS Security Report page to the Alert History page under Security & UEBA Alerts; the SaaS Security Report page no longer displays alert details.
Client Connector — ZDX Module Release Summary (2023) — 2023-05-18
May 18, 2023
· release notes
ZDX Module 3.7.1.31 adds Webex Call Quality Management support for Windows.
Supports Webex Call Quality Management (CQM) for Zscaler Client Connector and ZDX.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-18
May 18, 2023
· release notes
ZIA adds UEBA alert rules for inline and API channels with new alert types and dynamic actions.
Adds UEBA Alert rules for the inline channel that cover multiple events and alert types. Adds support for configuring UEBA alerts via both inline and API channels in the Alert Rules page (Alerts > Alert Rules). Adds dynamic actions for inline UEBA alerts, including Place user in a group and Trigger Multi-Factor Authentication .
3 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-05-18
May 18, 2023
· release notes
Client Connector 1.12 adds ZDX support for Web/Cloud Path probes and Tunnel 1.0 QUIC QUIC A UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. fallback on ChromeOS.
Adds ZDX support for Web probes, Cloud Path probes, and device statistics for Chromebooks Includes support for Tunnel 1.0 to drop QUIC (UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. -443) packets so applications can fall back to TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. -443
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-18
May 18, 2023
· release notes
Private Access simplifies isolation URLs by hiding internal identifiers in the path while retaining region and tenant data in query strings.
Simplifies isolation URL format to display a clean domain structure (<clusterid>.isolation.zscaler.com) with region and tenant identifiers preserved only in the query string.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-05-16
May 16, 2023
· release notes
Client Connector adds support for a new public CA certificate for Zscaler communications on iOS, Android, and ChromeOS.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-16
May 16, 2023
· release notes
ZPA App Connector and Private Service Edge add FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140-2 compliance via SHA-256 SHA-256 A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. for RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8
Adds FIPS Mode support for Zscaler Private Access App Connectors and Private Service Edge RPM packages on Red Hat Enterprise Linux 8 using SHA-256
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-15
May 15, 2023
· release notes
ZPA adds multi-condition Audit Log search and limited-availability Emergency Access for third-party privileged users.
Adds the ability to filter Audit Logs on the ZPA Admin Portal using multiple conditions simultaneously Introduces Emergency Access feature in Limited Availability, allowing admins to invite time-bound third-party user access to approved application segments via Okta IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for Privileged Remote Access
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-05-12
May 12, 2023
· release notes
New predefined apps (Login, Okta, Webex) and follow-redirect defaults for web probes in ZDX
Adds Microsoft Login, Okta, and Webex (web app) as predefined applications in the Zscaler Digital Experience (ZDX) Admin Portal Sets Follow Redirect to disabled by default for Box, Microsoft Teams Web App, OneDrive for Business, Outlook Online, ServiceNow, and SharePoint Online web probes
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-12
May 12, 2023
· release notes
ZIA adds Workflow Automation API with Key ID/Secret auth, ECS ECS Elastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. injection support, EDM multi-alphanumeric IDs, and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. file type/Tombstone template expansions
Adds Workflow Automation API for managing DLP incidents, requiring authentication via a new Key ID and Key Secret created on the API Keys page in the Workflow Automation Admin Portal. Adds support for configuring EDNS EDNS An extension to the DNS protocol, standardized by the IETF, that adds larger UDP payload sizes, option flags, and extensible fields; cyber tools use it to carry additional query metadata and avoid fragmentation issues. Client Subnet (ECS) prefixes under Administration > EDNS Client Subnet Prefix Objects and designating them in DNS request Advanced Settings. Adds new columns (ECS Object Name , ECS Prefix , ECS Prefix Length ) and filters to the DNS Insights Logs page. Makes the fields %s{ecs_prefix} and %s{ecs_slot} available for use when adding an NSS feed for DNS logs. Adds the ability to configure a Multi-alphanumeric Identity data type as a primary field in EDM Templates.
+5 more
show less
Adds a new Tombstone Template action in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Control policies, manageable on the Notification Templates > Quarantine > Tombstone Templates page in the ZIA Admin Portal. Adds Cascade to URL Filtering option to the Add/Edit Cloud App Control policy rule page (Policies > URL & Cloud App Control > Cloud App Control Policy > Add). Adds predefined DLP dictionaries for Tax Identification Numbers in Austria, Belgium, Denmark, France, Germany, Hungary, Luxembourg, New Zealand, Portugal, and Sweden. Adds file type support for AutoCAD (.dxf), Integrated Circuit Files (.gds, .gds2, .oas, .oasis), and Tableau files (.twb, .tbm, .twbx, .hyper, .tde, .tds, .tdsx) in File Type Control & DLP policies. Adds a Notification Center page to Workflow Automation listing alert notifications impacting the service.
10 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-12
May 12, 2023
· release notes
ZPA adds source port consumption event and ability to disable AppProtection via API
Adds a new event for tracking source port consumption to events diagnostics Adds ZPA Private Service Edge usage metrics to notification management Enables disabling AppProtection for App Connector Groups via the ZPA cloud service API
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-05-05
May 5, 2023
· release notes
ZIA adds Workflow Automation for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. incident remediation, ZPA Application Segment policy criteria, and EDNS EDNS An extension to the DNS protocol, standardized by the IETF, that adds larger UDP payload sizes, option flags, and extensible fields; cyber tools use it to carry additional query metadata and avoid fragmentation issues. Client Subnet injection support.
Admins can now use the new Workflow Access permission to configure Full workflow access or Restricted workflow access roles for managing Data Protection incidents via Workflow Automation Policies (DLP, Firewall Filtering, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, etc.) now accept ZPA Application Segment as a new rule criterion for source IP anchored traffic New widget Top Application Segments is available on Web Overview, Security, Web Browsing, Firewall Overview, and IPS Overview dashboards Admins can configure ECS ECS Elastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. prefixes under Administration > EDNS Client Subnet Prefix Objects and assign them via Advanced Settings to inject ECS into DNS queries DNS Insights Logs now include new columns ECS Object Name , ECS Prefix , and ECS Prefix Length
+1 more
show less
NSS Feed Output Format for DNS Logs now supports the fields %s{ecs_prefix} and %s{ecs_slot}
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-05
May 5, 2023
· release notes
ZPA introduces Privileged Remote Access (PRA) credential mapping for designated privileged consoles
Client Connector — ZDX Module Release Summary (2023) — 2023-05-03
May 3, 2023
· release notes
ZDX Module 3.5 adds remote packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. and Wi-Fi SNR computation
Supports Signal-to-Noise Ratio (SNR) computation for Wi-Fi interface.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-05-03
May 3, 2023
· release notes
iOS 1.9.4 adds Z-Tunnel 1.0 support for dropping QUIC QUIC A UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. packets to force TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fallback and fixes several connectivity issues.
Provides support for the current status of Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA), as seen in the Zscaler Client Connector Portal
1 detail in Everything
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-05-01
May 1, 2023
· release notes
A new combined VM image type allows operators to deploy both connector functions on a single VM for supported hypervisors.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-05-01
May 1, 2023
· release notes
ZPA introduces Branch Connector support with new grouping and policy configuration capabilities
Adds Branch Connector client type to Zscaler Private Access, allowing admins to view and configure policy rules for specific connectors and groups Introduces Branch Connector Groups and Locations as criteria for configuring access policies in the ZPA Admin Portal
2 details in Everything
└──▷ BREAKING ON UPGRADE
! Provisioning templates created before April 10, 2023 are no longer valid and must be replaced with new templates to provision Branch Connectors
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-28
Apr 28, 2023
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Device Discovery with new location fields and CSV bulk enablement
Adds City Geolocation and Enable IoT Discovery fields to the Add/Edit Location window in Administration > Location Management Adds support for enabling IoT discovery across multiple locations and sub-locations via a CSV file upload
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-21
Apr 21, 2023
· release notes
ZIA adds EDNS EDNS An extension to the DNS protocol, standardized by the IETF, that adds larger UDP payload sizes, option flags, and extensible fields; cyber tools use it to carry additional query metadata and avoid fragmentation issues. Client Subnet injection, Security Alerts with webhooks, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Discovery, ML-based DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries, and multiple DLP enhancements
Adds EDNS Client Subnet (ECS ECS Elastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. ) Injection to pass client subnet info in DNS queries, configured via Administration > EDNS Client Subnet Prefix Objects. Adds binNumbers and includeBinNumbers attributes to the DLP Cloud Service API to control inclusion of specific Bank Identification Numbers in credit card scans. Adds support for cloning identification-based predefined DLP dictionaries (e.g., Credit Cards, SSN) using the predefinedClone and dictTemplateId API attributes. Adds the Data Discovery Report under Analytics > Data Discovery Report for high-level DLP content overviews and drill-down insights. Adds 13 new predefined ML-Based DLP dictionaries (e.g., Corporate Finance, Legal, Medical) to detect specific document types automatically.
+8 more
show less
Adds upload/download file separation in logs: new fields %s{upload_filetype}, %s{upload_filename}, %s{upload_filesubtype}, %s{upload_fileclass} and their hex/b64 variants for NSS Feeds; new Document Type , Upload File Name /Type columns and filters in Web Insights Logs. Adds a JSON Array Notation toggle in the Add Cloud NSS Feed window to control output format structure (enabled by default for JSON). Adds the Allow Visitor Access field on the Add Tenant Profile page (Administration > Tenant Profiles > Add Tenant Profile) for Google App to grant visitor access. Adds an exclusion setting for 100% matches in Indexed Document Match (IDM) dictionaries, configurable via UI or DLP API endpoints. Adds the Sum operator in DLP Engine expressions to trigger actions based on the total count of matches across multiple dictionaries. Adds support for cloning predefined or custom DLP engines to duplicate functionality for different use cases. Adds Security Alerts console for viewing, managing, and creating alert rules with webhook delivery to third-party apps like ServiceNow/Splunk. Adds IoT Device Discovery and Report features: new City Geolocation and Enable IoT Discovery fields in Location/Sub-Location management; CSV support for bulk enabling IoT discovery.
13 details in Everything
└──▷ BREAKING ON UPGRADE
! The maximum number of restore points allowed per organization is changed to 12; older restore points (except the golden restore point) are deleted.
Client Connector — Client Connector App Release Summary (2023) — 2023-04-18
Apr 18, 2023
· release notes
Zscaler Client Connector 1.4.0.105 adds remote log fetching and RHEL RHEL Red Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. 8.5 validation
Adds an option to fetch logs remotely for enrolled devices without user intervention Validates the Client Connector app on Red Hat Enterprise Linux (RHEL) 8.5
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-14
Apr 14, 2023
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. Discovery reporting, Email Label actions in DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies, AI/ML URL categorization, and several DLP engine enhancements.
Adds City Geolocation and Enable IoT Discovery fields to the Add/Edit Location and Sub-Location windows for IoT Device Discovery Adds new email label action in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP and Malware policies to assign Gmail/Exchange labels based on content sensitivity Adds AI and ML Applications URL category to the Information Technology super category for generative AI site classification Adds binNumbers and includeBinNumbers attributes to DLP endpoints to include or exclude BIN values from credit card dictionary scans Adds predefinedClone and dictTemplateId attributes to DLP endpoints for cloning identification-based predefined DLP dictionaries
+10 more
show less
Adds Sum operator support in DLP engine expressions to specify the sum total of matches across a group of dictionaries Adds new Data Discovery Report at Analytics > Data Discovery Report with drill-down widgets for DLP content overview Adds IoT Discovery Report showing device inventory and insights from unauthenticated web traffic Adds Security Alerts feature in ZIA Admin Portal to view, manage, create, and adjust alert rules with webhook support Adds JSON Array Notation toggle in the Add Cloud NSS Feed window for JSON feed output formatting Adds new advanced filter, column, and data types (Document Type , Upload File Type , Download File Type ) to Web Insights and SaaS Security Insights Logs Adds upload/download file tracking fields to NSS Feeds: %{upload_filetype}, %{upload_filename}, %{upload_filesubtype}, %{upload_fileclass}, eupload_filename, b64upload_filename, %{upload_doctypename} Adds support for Cloning DLP Engines to duplicate predefined or custom engines Adds 13 new predefined ML-Based DLP dictionaries including Corporate Finance, Legal, Medical, Tax, and Transportation document types Adds Allow Visitor Access field to the Add Tenant Profile page for Google App
15 details in Everything
└──▷ BREAKING ON UPGRADE
! The maximum number of restore points allowed per organization is changed to 12; if you currently have more than 12 restore points, only the most recent 12 are retained after this upgrade and all other older restore points except the golden restore point are deleted.
Client Connector — ZDX Module Release Summary (2023) — 2023-04-12
Apr 12, 2023
· release notes
ZDX Module 3.7.0.14 adds TLS/SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. cipher removal for compliance support
Removes legacy ciphers from the Zscaler Client Connector’s TLS and SSL connections for compliance
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! The Zscaler Client Connector will no longer negotiate legacy ciphers over TLS and SSL connections.
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2023) — 2023-04-12
Apr 12, 2023
· release notes
ZPA 23.63.4 adds disaster recovery config/binary snapshot management and debugging commands
Adds support for backup and management of disaster recovery configuration and binary snapshots for ZPA Private Service Edge Groups. Releases new debugging commands for disaster recovery troubleshooting in ZPA Private Service Edge.
2 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-04-12
Apr 12, 2023
· release notes
Zscaler Client Connector 4.2 for Windows adds latency-based ZIA proxy selection, C2C remote assistance, synthetic IP range support, and ARM64 ARM64 The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. compatibility.
Supports configuring dynamic ZIA Public Service Edge use based on probe interval, frequency, and threshold limit settings Assigns a virtual IP address to support Server-to-Client applications like remote troubleshooting and software distribution Adds the ability to configure the VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. name for flow logging Adds configurations to display critical notifications for ZPA reauthentication, system reboot requests, captive portal, and packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. Enhances the built-in browser for IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. authentication using WebView2, supporting MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. and FIDO authentication methods for YubiKey
+13 more
show less
Supports configuring a one-time password (OTP OTP One-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. ) to disable anti-tampering and enabling ZEP driver root CA certificate validation for trusted processes Supports force reverting to a previous version in the Client Connector App Store Supports blocking access to keyboard shortcuts and drag-and-drop in the WebBrowser Control (WBC) Supports configuring advanced authentication notification alerts for ZPA applications Supports including browser-based configurations in keepalive policy downloads Supports the PcapNG file format for packet capture Adds a configurable option to force ZPA authentication on sleep/hibernation wake, system restart, or network IP change Supports configuring a preferred port for SME server communication Allows configuration of the default RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. 3389 bypass Supports the Windows 365 platform with additional configuration Supports Advanced RISC Machines (ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. ) architecture in 64-bit with AMD64 builds in compatibility mode Supports ZPA client-to-client (C2C) remote assistance for Azure AD domain-joined and hybrid-joined devices Supports adding certificate template information of the issued certificate for Client Certificate posture type
18 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes support of legacy cipher suites from Zscaler Client Connector TLS connections.! (CVE-2023-28802) A user could disable ZIA or ZPA from the Machine Tunnel diagnostics page without a password.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-04-12
Apr 12, 2023
· release notes
ZPA adds disaster recovery config backup/management and reauth notification for Zscaler Client Connector.
Adds the ability to backup and manage disaster recovery configuration for App Connector Groups and Private Service Edge Groups Adds debugging commands for disaster recovery troubleshooting on App Connectors and Private Service Edges Enhances Microtunnel connections to notify Zscaler Client Connector users prior to reauthentication
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-04-07
Apr 7, 2023
· release notes
ZIA adds Security Alerts webhooks, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. cloning/sum expressions, basic auth locations, and new AI URL category
Adds Enable Basic Authentication option in the Add Location window (Administration > Location Management > Add Location) and Add Sub-Location window to enforce basic auth on traffic from a location or sub-location, with CSV import support for multiple locations. Adds binNumbers and includeBinNumbers attributes to DLP endpoints within the cloud service API to include or exclude BIN values from predefined DLP credit card dictionaries. Adds predefinedClone and dictTemplateId attributes to DLP endpoints within the cloud service API to clone identification-based predefined DLP dictionaries. Adds a Sum operator in expressions for creating, editing, or cloning Data Loss Prevention (DLP) engines to specify the sum total of matches that trigger a group of dictionaries. Adds support for cloning predefined or custom Data Loss Prevention (DLP) engines.
+5 more
show less
Adds a JSON Array Notation toggle in the Add Cloud NSS Feed window for Feed Output Type, enabled by default when selecting JSON. Adds the Allow Visitor Access field to the Add Tenant Profile page (Administration > Tenant Profiles > Add Tenant Profile) for Google App. Adds the AI and ML Applications URL category under Information Technology for sites providing generative AI tools/services. Adds Security Alerts feature in the ZIA Admin Portal with a centralized console to view, manage, create, and adjust alert rules, plus webhook support for third-party applications like ServiceNow and Splunk. Adds Confluence support to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API, including tenant configuration, control policies, scan schedules, assets reports, insights logs, and NSS feeds.
10 details in Everything
└──▷ BREAKING ON UPGRADE
! The maximum number of restore points allowed per organization is changed to 12; older restore points are deleted except the golden restore point.
Client Connector — Client Connector App Release Summary (2023) — 2023-04-07
Apr 7, 2023
· release notes
Client Connector 1.10.3 adds Z-Tunnel 1.0 support to force TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. fallback by dropping QUIC QUIC A UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. packets on Android.
Adds Z-Tunnel 1.0 support to drop QUIC (UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. 443) packets, enabling applications to fall back to TCP 443.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-31
Mar 31, 2023
· release notes
ZIA adds Confluence SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API support, AWS AMI for Incident Receiver, new PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. variables, and User Risk Profile criteria.
Adds ${TRUSTED_NETWORK}, ${ZS_CUSTOM_PORT}, and ${ZT2_REQUEST} as usable variables in custom PAC files via the ZIA Admin Portal. Enables deployment of the Zscaler Incident Receiver on AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. VMs using an Amazon Machine Image (AMI) supporting S3 or SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. storage. Adds User Risk Profile levels (Low, Medium, High, Critical) as a selectable criterion in Cloud App Control, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. with Content Inspection, DLP without Content Inspection, and URL Filtering policies. Adds Confluence application support to SaaS Security API control policies, scan schedules, assets reports, insights logs, and NSS feeds. Adds Bitbucket, GitHub, Google Workspace, Microsoft 365, and Salesforce to the SaaS Security Posture Control policy and report.
+3 more
show less
Expands SaaS Security Posture Report compliance options with CIS CIS A nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. Google Workspace v1.0.0, CIS Microsoft 365 v1.4, HIPAA HIPAA A US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. , ISO ISO A widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 27001, NIST 800-53 NIST 800-53 A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. Rev.4, NIST 800-53 Rev.5, PCI DSS PCI DSS The Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers. v3.2, SOC2 AICPA TSC 2017, and GDPR. Adds Enable Basic Authentication option in the Add Location and Add Sub-Location windows (Administration > Location Management) to enforce auth on traffic. Adds support for Microsoft Azure Sentinel and Amazon S3 as new Cloud NSS SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. destinations.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! The External Owner field is renamed to Non-Provisioned Owner in the SaaS Security Insights Logs, SaaS Assets Report, and NSS Feeds filters.
Client Connector — Release Upgrade Summary (2023) — 2023-03-31
Mar 31, 2023
· release notes
Zscaler Client Connector Portal 3.22.1 adds synthetic IP range support and QUIC QUIC A UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. fallback for Z-Tunnel 1.0.
Adds the ability to use the Zscaler Client Connector synthetic IP range on the LAN address space via Portal configuration. Allows Z-Tunnel 1.0 to drop QUIC (UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. 443) packets for specific websites, enabling a fallback to TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. 443 on Android and iOS clients.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-24
Mar 24, 2023
· release notes
ZIA adds Cloud NSS for Azure Sentinel/S3, User Risk Profile criteria, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Posture policies for Jira/GitHub/etc., and Incident Receiver AMI deployment
Cloud Nanolog Streaming Service (NSS) now supports streaming logs to Microsoft Azure Sentinel and Amazon Simple Storage Service (S3) without an NSS VM. User Risk Profile allows filtering users by risk score levels (Low , Medium , High , Critical ) in Cloud App Control , Data Loss Prevention with Content Inspection , Data Loss Prevention without Content Inspection , and URL Filtering policies.New applications available for SaaS Security Posture Control policy and report: Bitbucket , GitHub, Google Workspace , Microsoft 365 , Salesforce , Jira Software , and Confluence . New compliance standards supported in SaaS Security Posture Report: CIS Google Workspace v1.0.0, CIS Microsoft 365 v1.4, HIPAAHIPAA A US federal law enacted in 1996 that sets privacy and security requirements for protected health information, giving cyber tools a compliance baseline to enforce or audit against. , ISO 27001, NIST 800-53 Rev.4, NIST 800-53 Rev.5, PCI DSS v3.2, SOC2 AICPA TSC 2017, and GDPRGDPR EU regulation enacted in 2018 that governs how organizations collect, store, and process personal data of EU residents, giving cyber tools legal obligations around data handling and breach notification. . Zscaler Incident Receiver can now be deployed on AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. VMs using an Amazon Machine Image (AMI) with storage options Amazon S3 or SFTPSFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. .
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The External Owner field is renamed to Non-Provisioned Owner in SaaS Security Insights Logs, SaaS Assets Report, and NSS Feeds.
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-03-20
Mar 20, 2023
· release notes
ZPA Admin Portal adds Web Probe cacheless/HTTP/S values to Connection Type filter and admin role filtering
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-03-17
Mar 17, 2023
· release notes
ZDX adds Department-based scope for Admins and Remote Assistance Device Info Obfuscation
Updates Add/Edit ZDX Admin window to allow selecting Department as a scope criteria Adds Visible/Obfuscated toggle for Device Information in the Remote Assistance window
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-17
Mar 17, 2023
· release notes
ZIA adds PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file variables (TRUSTED_NETWORK, ZS_CUSTOM_PORT, ZT2_REQUEST) and AMI deployment for Incident Receiver on AWS EC2 EC2 Amazon's cloud virtual-machine service, letting tools run on-demand servers without managing physical hardware. .
${TRUSTED_NETWORK}, ${ZS_CUSTOM_PORT}, and ${ZT2_REQUEST} are now available as new variables in custom PAC files written via the ZIA Admin PortalThe Zscaler Incident Receiver can now be deployed on AWS EC2 using an Amazon Machine Image (AMI), supporting Amazon S3 or SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. storage backends
2 details in Everything
Deception — Release Upgrade Summary (2023) — 2023-03-15
Mar 15, 2023
· release notes
Zscaler Deception adds Zero Trust Network decoys in ZPA, browser lures for Edge, and evidence file export.
Adds the ability to create a Zero Trust Network Decoy of a real or production application in Zscaler Private Access (ZPA) by adding it as an unused port to an existing application segment with at least one FQDN. Adds the Deception Strategy feature, allowing configuration of ready-to-use personalities/tags for Internal, Threat Intelligence (TI), and Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. (AD) decoys, plus Landmine policies on a single page. Adds response rules to forward detected IOC IOC An indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. IP, IOC Hash, and IOA process tree activities to CrowdStrike with specified actions. Adds configurable custom response headers for Threat Intelligence (TI) decoys and web services on Internal decoys to manipulate HTTP responses seen by adversaries. Adds a default expiration period configuration (in hours) for containment integrations with Palo Alto Networks and Fortinet, applicable to response rules.
+5 more
show less
Adds export functionality for evidence files collected during investigation to CSV or JSON via the Investigate page. Adds visibility controls (show/hide) for internal (built-in) safe processes on the Safe Processes page under Deceive > Landmine > Safe Processes. Adds prebuilt security and Strict-Transport-Security (HSTS HSTS An HTTP response header, standardized in RFC 6797, that instructs browsers to contact a site over HTTPS only for a declared period, preventing protocol-downgrade and cookie-hijacking attacks. ) headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy Permissions-Policy An HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. , Content-Security-Policy) for Web Services on Internal decoys. Adds support for configuring browser lures (decoy cookies, favorites, credentials) in the Microsoft Edge browser on endpoints. Adds openSUSE Leap 15.3 and later to the supported Linux distribution list for Landmine Agent and Agentless installations.
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-14
Mar 14, 2023
· release notes
ZIA Admin Portal now manages Browser Isolation profiles and certificates
Client Connector — Client Connector App Release Summary (2023) — 2023-03-09
Mar 9, 2023
· release notes
Android Client Connector 1.10.2 adds PKCE PKCE Proof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. verification for ZIA user enrollment
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-07
Mar 7, 2023
· release notes
ZIA Admin Portal now supports full management of Browser Isolation profiles and certificates.
Enables ZIA admins to manage Zscaler Root Certificates , Isolation Profiles , and Isolation Banners directly within the ZIA Admin Portal.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-03-03
Mar 3, 2023
· release notes
ZIA introduces Security Alerts console with webhook integration and enhanced file upload/download logging fields in NSS feeds.
Adds a new Security Alerts feature in the ZIA Admin Portal to view, manage, and create alert rules for configured events. Enables creation of webhooks to deliver Security Alerts to third-party applications like ServiceNow or Splunk. Supports Amazon Web Services in Tenant Profiles to provide access to specific AWS account IDs. Adds new filters and columns in Insights Logs, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs, and Web Insights Logs for file upload/download details (e.g., Upload File Type , Download File Name )
4 details in Everything
Client Connector — Release Upgrade Summary (2023) — 2023-03-03
Mar 3, 2023
· release notes
Zscaler Client Connector Portal 3.22 adds profile cloning, global log mode config, and a service status CSV API
Adds the ability to clone Zscaler Client Connector Profiles in the Zscaler Client Connector Portal. Adds support for configuring a default global log mode for all new Zscaler Client Connector profiles that customers can override in App Profiles. Adds a public API to download the service status for devices as a CSV file. Enables customers to search within Forwarding Profile, App Profiles, Device Posture Profile, ZIA Device Posture Profile, Device Groups, and Trusted Networks in the Zscaler Client Connector Portal.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Changes the default Tunnel Driver Type for the Windows Driver Selection in Forwarding Profile from a Route-Based driver to a Lightweight Filter (LWF) driver for new customers.
Client Connector — Client Connector App Release Summary (2023) — 2023-03-03
Mar 3, 2023
· release notes
Client Connector 1.9.3 for iOS adds PKCE PKCE Proof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. verification for user enrollment and fixes AUP bypass.
Adds verification using proof key for code exchange (PKCE) with ZIA for user enrollment.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-03-03
Mar 3, 2023
· release notes
New AWS Marketplace and Azure Portal images for App Connectors and ZPA Private Service Edge.
Adds support for the latest Manager software updates via new App Connector and ZPA Private Service Edge images available in the AWS Marketplace. Adds a new App Connector image to the Microsoft Azure Portal.
2 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-03-02
Mar 2, 2023
· release notes
Client Connector 4.0.0.89 adds configurable synthetic IP range for LAN address space.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-02-24
Feb 24, 2023
· release notes
ZDX adds a dotted reference line to the Impacted User Devices chart in Alert Details, based on alert rule criteria.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-24
Feb 24, 2023
· release notes
ZIA adds Hyper-V support for VSE, multiple SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. connections for Incident Receiver, and more cloud app instances.
Adds storage_sftp_conn_max parameter to Zscaler Incident Receiver config to allow 1-16 simultaneous SFTP connections Extends Virtual Service Edge support to Microsoft Hyper-V Hypervisor via VM files downloadable from Administration > Virtual Service Edges Increases SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API scan limit for Amazon S3, Google Cloud Platform buckets, and Azure blob containers from 32 to 1000 Adds Email Tag action capability in SaaS Security API Control policies for Gmail and Microsoft Exchange DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /Malware rules Extends Cloud Application Instances support to Appspace, Bitbucket, GitHub, Launchpad, Quick Base, Slack, SourceForge, Workday, Zeplin, and Zoom
5 details in Everything
Client Connector — Release Upgrade Summary (2023) — 2023-02-24
Feb 24, 2023
· release notes
Zscaler Client Connector Portal 3.22 adds profile cloning, global log mode defaults, device service status API, and IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. bypass support for Zoom/Teams.
Adds the ability to clone Zscaler Client Connector Profiles in the Zscaler Client Connector Portal. Supports configuring a default global log mode for all new Zscaler Client Connector profiles that customers can override in App Profiles. Adds a public API to download the service status for devices as a CSV file. Supports IPv6 IPs for Zoom and Microsoft Teams in application bypass. Syncs department information from Zscaler Internet Access (ZIA) and displays it on the Device Details page in Enrolled Devices.
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Changes the default Tunnel Driver Type for the Windows Driver Selection in Forwarding Profile from a Route-Based driver to a Lightweight Filter (LWF) driver for new customers.
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-02-24
Feb 24, 2023
· release notes
Cloud & Branch Connector adds EUSA acceptance workflow and weekly scheduling for connector upgrades in the portal.
Adds End User Subscription Agreement (EUSA) to the Cloud Connector Portal for admin acceptance Enables selection of the specific day of the week for scheduled cloud connector software upgrades via the Edit Connectors window
2 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-02-22
Feb 22, 2023
· release notes
Client Connector 3.9.0.189 allows synthetic IP range usage on LAN address space via portal config
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-17
Feb 17, 2023
· release notes
ZIA adds AWS support for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. EDM Index, Cloud HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. intermediate CAs, Device Trust levels, and new SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API scan limits.
└──▷ USE IT
Configure multiple SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. connections on the Incident Receiver VM to prevent queue saturation.
config
copy
storage_sftp_conn_max=2
Manage intermediate CA certificates for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection using the new API endpoints.
api
copy
GET /intermediateCaCertificate
Supports configuring the DLP EDM Index Tool with Amazon Web Services (AWS) by using an AMI ID provided by Zscaler support Adds storage_sftp_conn_max config parameter (1-16) to Zscaler Incident Receiver VM to allow multiple simultaneous SFTP connections Deprecates /sslSettings API endpoints in favor of new /intermediateCaCertificate endpoints for managing intermediate CA certificates Adds Cloud HSM support for custom intermediate CA certificates, allowing up to 8 certificates per tenant for cloud HSM protection type and 2 for software protection type Enables applying email tags for Gmail and Microsoft Exchange under DLP or Malware rules in SaaS Security API Control policies
+5 more
show less
Expands SaaS Security API scan limit for Amazon S3 buckets, Google Cloud Platform buckets, and Azure blob containers from 32 to 1000 Adds External Device ID column and filter option to Firewall and Web Insights Logs Adds %s{external_devid} and %s{external_deviceid} fields for NSS Feeds in Web logs and Firewall logs respectively Adds Intermediate CA Protection Type weblog field and new SSL Policy Reason actions (e.g., Not inspected because of HSM error ) to Web Insights Logs Adds support for Device Trust Levels in SSL Inspection, Firewall Filtering, File Type Control, Cloud App Control, and URL Filtering policies
10 details in Everything
└──▷ BREAKING ON UPGRADE
! The /sslSettings endpoints are deprecated; new management must use /intermediateCaCertificate endpoints! The Advanced SSL Inspection Settings tab is replaced with a new Intermediate CA Certificates tab in the ZIA Admin Portal
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-02-17
Feb 17, 2023
· release notes
Zscaler Cloud & Branch Connector adds EUSA acceptance workflow and weekly upgrade scheduling in the portal.
Adds a mandatory End User Subscription Agreement (EUSA) that appears in the Zscaler Cloud Connector Portal upon first login for organization admins Enables selection of the day of the week for scheduled software upgrades within the Edit Connectors window
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-10
Feb 10, 2023
· release notes
ZIA adds Cyber Risk Report, SFTP SFTP SSH File Transfer Protocol, a file transfer standard built on top of SSH that provides encrypted upload, download, and remote file management; cyber tools use it to move files or exfiltrate data over an authenticated, encrypted channel. concurrency settings, and new log fields for Client Source Port and Admin Audit types.
└──▷ HOW TO FIND IT
Navigate to the new analytics view to evaluate organization policy posture against emerging cyber threats.
📍 Analytics › Cyber Risk Report
Adds storage_sftp_conn_max config parameter to Zscaler Incident Receiver to allow up to 16 simultaneous SFTP connections Adds a new Cyber Risk Report in Analytics > Cyber Risk Report providing policy posture visibility and risk scoring Adds Admin Audit log type to NSS Feeds and Cloud NSS Feeds for Branch Connector, Client Connector, ZDX, and ZIA Portal audit logs Adds Apple Documents file type support (keynote, numbers, pages) in File Type Control & DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies under the Other Documents category
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-02-03
Feb 3, 2023
· release notes
ZIA adds OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API auth, Cloud App Instance control, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file versioning, and SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. admin deletion support.
Adds includeApiRole query parameter to the GET /adminRoles/lite API endpoint. Adds API role configuration under Administration > Role Management > Add API Role for OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 client applications. Adds OAuth 2.0 Authorization Server management under Administration > Cloud Service API Security > OAuth 2.0 Authorization Servers. Adds Caution action to Cloud App Category Rules in Policy > URL & Cloud App Control > Cloud App Control Policy. Adds Cloud Application Instances feature for granular control based on instance identifiers.
+26 more
show less
Adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. detection for Italian Fiscal Codes and Hong Kong Identity Card Numbers via new predefined dictionaries. Adds Inspect Downloads option to DLP policy rules with content inspection. Adds Cloud Applications criterion to File Type Control rules. Adds granular Viewing/Allow, Viewing/Block, Viewing/Isolate, Uploading/Allow, and Uploading/Block actions for System & Development cloud app control rules. Adds Active Content and Unscannable Files criteria to File Type Control rules. Allows custom minimum threat score (40-70) configuration in Sandbox Policy with AI Quarantine. Adds Sandbox Offsec Tools, Ransomware, and Suspicious categories to Sandbox Rules and Insights Logs filters. Adds new Cloud Application attributes including File Sharing, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Cert Key Size, and various vulnerability flags under Risk Profiles. Adds support for new file types in Archive, Audio, Database, Executable, Image, Mac Documents, Media, Microsoft Office, Mobile, Online Gaming, Open Office Files, Other Documents, Source Code, Video, and Web Content categories for File Type Control and DLP. Adds Secure Browsing module with Smart Browser Isolation policy configuration. Adds support for configuring future actions on admin account deletion via SCIM in Advanced Configuration. Adds custom MD5 file hash support with endpoints GET /behavioralAnalysisAdvancedSettings, PUT /behavioralAnalysisAdvancedSettings, and GET /behavioralAnalysisAdvancedSettings/fileHashCount. Adds Event Logs page and SCIM activity report endpoints GET/POST/DELETE /eventlogEntryReport and GET /eventlogEntryReport/download. Adds Hosted PAC Files table columns (Name, Number of Hits, Currently Deployed Version), Export icon, Preview Version Details, and Manage PAC File pages. Updates PAC file verification to capture broader JavaScript errors with line numbers. Increases maximum number of PAC files per organization default from 256 to 1024. Adds Audit Log actions for PAC versioning: Change Deployed PAC Version, Create New PAC Version, Delete PAC, Delete PAC Version, Stage PAC Version. Adds ability to override Zscaler-computed risk index value for cloud applications. Adds Subcloud management features to edit and temporarily disable data centers. Renames IP Address or FQDN field to IP Address or Wildcard FQDN in Firewall Filtering Policy, NAT Control Policy, and IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control. Renames Destination IP Address / FQDN to Destination IP Address / Wildcard FQDN in Forwarding Control policy. Renames FQDN Domain type to Wildcard FQDN in Destination Groups. Adds Blocked by Web Proxy Policy firewall filtering rule indicator to Firewall Insights Logs. Adds DLP actions (Quarantine, Remove, etc.) for CRM and ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. Applications in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Control Policies. Adds Remove Malware action for CRM and ITSM Applications in SaaS Security API Malware Detection Policy. Adds User Risk Report page to monitor organization's risk exposure from a user perspective.
31 details in Everything
└──▷ BREAKING ON UPGRADE
! Microsoft Internet Explorer is no longer supported.
Cloud & Branch Connector — Release Upgrade Summary (2023) — 2023-02-03
Feb 3, 2023
· release notes
Zscaler Cloud Connector adds multi-language portal support and separates API key management from ZIA.
Adds multiple language support for the Zscaler Cloud Connector Portal (English, French, German, Japanese, Spanish, Simplified Chinese). Makes the API key exclusive to the Zscaler Cloud Connector Portal, no longer shared with the Zscaler Internet Access (ZIA) Admin Portal.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-01-31
Jan 31, 2023
· release notes
Adds Top Application Segments and Top Disaster Recovery App Segments by Bandwidth widgets to the ZPA Application dashboard
Adds Top Application Segments by Bandwidth widget to visualize top application segments using the most bandwidth for your organization in a specified time frame. Adds Top Disaster Recovery App Segments by Bandwidth widget to visualize top disaster recovery application segments using the most bandwidth for your organization in a specified time frame.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-01-30
Jan 30, 2023
· release notes
ZIA adds User Platform Mirroring in User Agent String and Zoom In/Out Settings for Cloud Browser Isolation
Cloud Browser Isolation mirrors the client device platform in the user agent string so web pages serve platform-appropriate content Adds CTRL +/- keys (Windows) and Command =/0 keys (Linux) to zoom in/out of web pages while in Cloud Browser Isolation
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-01-30
Jan 30, 2023
· release notes
ZPA adds user platform mirroring in Cloud Browser Isolation and Zoom In/Out settings.
Adds user platform mirroring to the Cloud Browser Isolation User Agent String so web pages respond with platform-appropriate content Adds Zoom In/Out capabilities for isolated web pages using CTRL +/- on Windows or Command =/0 on Linux
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2023) — 2023-01-27
Jan 27, 2023
· release notes
ZDX adds alert rule copying, PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. in deep tracing, Salesforce support, and Citrix path visualization.
Adds Alert Rule Copy Capability to the Alerts page for cloning existing rule configurations Enables Packet Capture (PCAP) for network trafficking within Deep Tracing Sessions Adds predefined application support for Salesforce Classic and Salesforce Lightning interfaces
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-01-27
Jan 27, 2023
· release notes
ZIA adds MIP label DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. actions in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API policies and Client Source Port logs to NSS feeds
Adds MIP label configuration option in the Add DLP Rule window for OneDrive/SharePoint tenants in SaaS Security API Control policy Adds %d{clt_sport} field for client source port in NSS Feed Output Format for web logs
2 details in Everything
Client Connector — Client Connector App Release Summary (2023) — 2023-01-25
Jan 25, 2023
· release notes
ZCC 3.9 for macOS adds PKCE PKCE Proof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. enrollment, Z-Tunnel 2.0 options, custom MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. profiles, and CLI username param
Adds verification using proof key for code exchange (PKCE) with ZIA for user enrollment to prevent CVE-2023-28799 and CVE-2023-28800. Provides support for configuring a custom settings profile for system extension in MDMs MDMs Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. . Includes the ability to enable or disable the exclusion DNS servers in the routing table for macOS. Adds the username parameter to the command-line interface to specify a unique username for each machine. Enhances the strict enforcement feature to block all ports and protocols.
+6 more
show less
Adds two new options for the Z-Tunnel 2.0 protocol bypass feature: Redirect Web Traffic to ZCC Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic. Supports overriding the Z-Tunnel 2.0 protocol settings by adding a new option on the User Privacy page. Allows Zscaler Client Connector to evaluate trusted network criteria against all default route adapters. Supports assigning specific entitlements to devices based on posture. Supports skipping trusted network criteria evaluation for Split VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Trusted Network detection. Enables customers to configure fallback options on Z-Tunnel 2.0 establishment failure.
11 details in Everything
└──▷ BREAKING ON UPGRADE
! The macOS package installer now requires administrators to update their MDM workflows due to a new process.
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2023) — 2023-01-24
Jan 24, 2023
· release notes
ZPA adds country code policy support and CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage logging in v22.385.2
Adds country code support in policies for ZPA Private Service Edges. Provides CPU usage data in journalctl logs every minute.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-01-20
Jan 20, 2023
· release notes
ZIA adds Hyper-V support for Virtual Service Edges and new Admin Audit log type for NSS feeds.
Adds Microsoft Hyper-V Hypervisor support for ZIA Virtual Service Edge, allowing VM creation and clustering via the Administration > Virtual Service Edges page Adds Client Source Port filter and column to Web Insights Logs in the ZIA Admin Portal Adds new Admin Audit log type to NSS Feeds and Cloud NSS Feeds, supporting Branch Connector, Client Connector, ZDX, and ZIA Portal audit reports
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-01-18
Jan 18, 2023
· release notes
Adds Platform as a policy criteria option for access and inspection policies in ZPA.
Internet & SaaS (ZIA) — Release Upgrade Summary (2023) — 2023-01-13
Jan 13, 2023
· release notes
ZIA adds Client Source Port to Web Insights Logs filters/columns and NSS feed output format
Adds a new Client Source Port column and filter to Web Insights Logs in the ZIA Admin Portal Makes the %d{clt_sport} field available in NSS feed output format for web logs
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2023) — 2023-01-13
Jan 13, 2023
· release notes
ZPA adds VNC protocol support for Privileged Remote Access on App Connector 22.354.4
Assign the VNC protocol type to privileged consoles in Zscaler Private Access App Connectors (requires version 22.354.4 or later). Enable Virtual Network Computing access via the Privileged Remote Access portal for remote administration.
2 details in Everything
Client Connector — ZDX Module Release Summary (2023) — 2023-01-10
Jan 10, 2023
· release notes
ZDX Module for Windows gains improved egress detection and adaptive trace route integration for reverse cloud path analysis.
Improves egress detection accuracy and utilizes it as the destination for reverse cloud paths from Zscaler Internet Access (ZIA) Public Service Edge or Private Service Edge.
1 detail in Everything
Deception — Release Upgrade Summary (2023) — 2023-01-04
Jan 4, 2023
· release notes
Zscaler Deception adds safe landmine filtering, SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. forwarding, DNS export for TI decoys and VMware Carbon Black integration.
Adds Executable file path , Executable file hash , Certificate issuer , Certificate serial number , and Certificate thumbprint parameters to configure safe Landmine processes that suppress false positive events from legitimate security tools. Enables forwarding of events marked as safe by Zscaler Deception to connected SIEM solutions via the new Service Connectors (formerly SIEM Connectors). Adds the ability to export DNS configuration details for Threat Intelligence (TI) decoys. Integrates with VMware Carbon Black Endpoint Standard to quarantine infected endpoints by blocking network communication instead of relying on isolate policies. Prebuilt security headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy Permissions-Policy An HTTP response header that lets a server declare which browser features—camera, geolocation, microphone—are allowed or blocked for a page and its iframes, replacing the older Feature-Policy header. , Content-Security-Policy, and Strict-Transport-Security) are now included on Threat Intelligence decoy responses.
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The SIEM Connectors page in the Admin Portal is renamed to Service Connectors (Orchestrate > Service Connectors).! The Policies column on the Agents page (Deceive > Landmine > Agents) is renamed to Matched Policies.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-12-16
Dec 16, 2022
· release notes
ZIA adds Jira/Bitbucket to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API & Posture, new Apple file types, and intermediate CA management via /intermediateCaCertificate API.
Adds Jira Software and Bitbucket as supported applications for SaaS Security API control policies, scan configuration, assets reports, insights logs, and NSS feeds Adds Bitbucket tenant configuration support in SaaS Security Posture Control Enables configuring multiple custom intermediate CA certificates (up to 8 for Cloud HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. , up to 2 for Software protection) via the new /intermediateCaCertificate API endpoints Deprecates /sslSettings endpoints in favor of /intermediateCaCertificate endpoints for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policy management Adds Intermediate CA Protection Type weblog field to Web Insights Logs for filtering and column display
+2 more
show less
Supports the %s{keyprotectiontype} variable in NSS feeds for web logs Adds Apple Documents file type (keynote, numbers, pages) to File Type Control and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The /sslSettings/generatecsr, /sslSettings/downloadcsr, /sslSettings/showcert, /sslSettings/uploadcert/text, /sslSettings/uploadcertchain/text, and /sslSettings/certchain endpoints are deprecated; use the new /intermediateCaCertificate endpoints instead.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-12-16
Dec 16, 2022
· release notes
ZPA adds support for Zscaler Client Connector to establish separate Z-Tunnels for partner tenants.
Adds Client Connector Partner option to access policies to support multiple tenant tunnels
1 detail in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-12-16
Dec 16, 2022
· release notes
Client Connector v4.1 for Windows adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, Z-Tunnel 2.0 MTU discovery, partner ZPA tenant integration, and auto-proxy update on network change.
└──▷ HOW TO FIND IT
Enforce IPv6 policies by defining specific ranges that bypass or include ZIA processing.
📍 Configuring Zscaler Client Connector Profiles
Adds IPv6 inclusions and exclusions for Zscaler Internet Access (ZIA) to control which IPv6 traffic is processed by the connector Supports Z-Tunnel 2.0 IPv6 traffic on IPv6-enabled Windows devices Allows admins to update system proxy settings automatically on any network change detection Adds enhancement to resume Packet Capture after a tunnel restart if it was not completed before the restart Provides anti-tampering solution for processes, services, files, and registry keys
+1 more
show less
Supports Partner Zscaler Private Access (ZPA) Tenant function to allow or remove access to partner ZPA resources
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-12-09
Dec 9, 2022
· release notes
ZIA adds device trust levels to policy APIs/log filters, Apple file types to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and Bitbucket/Jira SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. security support
deviceTrustLevels, devices, and deviceGroups fields added to Firewall and URL Filtering API endpoints (GET/POST/PUT /firewallFilteringRules* and /urlFilteringRules*) for device-aware policy rulesNew Client SSL Handshake Failure Reason and Client SSL Handshake Failure Aggregate Count filters/columns in Web Insights Logs, with NSS feed output fields %s{cltsslfailreason} and %d{cltsslfailcount} SaaS Security API and SaaS Security Posture Control now support tenant configuration, policies, and reporting for Bitbucket and Jira Software File Type Control & DLP now recognize Apple Documents file types (keynote, numbers, pages) as a new category
4 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-12-09
Dec 9, 2022
· release notes
Zscaler Client Connector Portal 3.21.2 adds per-device logs, Web 2.0 browser control, ZIA traffic interception from any adapter, and macOS firewall/routing exclusions.
Adds the option to have Zscaler Client Connector collect logs per device Provides the ability to use the Web 2.0 web browser control in Zscaler Client Connector Includes the option to intercept Zscaler Internet Access (ZIA) traffic from any network adapter in the Zscaler Client Connector profile Adds public API information in the Zscaler Client Connector Portal audit logs Provides the option to disable the Zscaler firewall for macOS if ZIA is active
+4 more
show less
Includes the ability to enable or disable the exclusion DNS servers in the routing table for macOS Adds a link to the Zscaler Client Connector APIs from the Public API page in the Zscaler Client Connector Portal Provides an anti-tampering solution for processes, services, files, and registry keys Supports configuring a preferred port to enable Zscaler Client Connector to SME server communication
9 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-12-09
Dec 9, 2022
· release notes
Cloud & Branch Connector gains custom DNS resolution and selectable tunnel encryption modes (DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. /Unencrypted).
Adds support for forwarding non-ZPA workload-initiated DNS requests to custom resolvers such as AWS Route 53 or Azure DNS Server Enables selection of DTLS or Unencrypted options for the tunnel encryption mode in the Edit Connectors window
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-12-08
Dec 8, 2022
· release notes
ZIA adds automatic DPI setting synchronization for isolation containers when switching displays.
Isolation containers now automatically match the DPI settings of the user's device and update them when the session moves to a different display.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-12-08
Dec 8, 2022
· release notes
Isolation container DPI now syncs with the active display during sessions
Isolation containers now dynamically match the DPI settings of the currently active display when a session is moved between monitors.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-12-07
Dec 7, 2022
· release notes
Zscaler Client Connector updates include new FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. support for ChromeOS and various bug fixes for Windows and ChromeOS connectivity and detection issues.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-12-05
Dec 5, 2022
· release notes
ZPA adds Login Hint option for IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration and platform details to the Private Service Edge page
Adds Login Hint toggle in the ZPA Admin Portal IdP configuration to prepopulate usernames on the external IdP sign-in page
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-12-02
Dec 2, 2022
· release notes
ZIA adds Bitbucket and Jira SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API support, Device Trust Levels to APIs/policies, Apple file types to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , and Hyper-V VSE support.
Adds Bitbucket and Jira Software tenant configuration and scanning for the SaaS Security API Adds deviceTrustLevels criteria to Firewall Filtering and URL Filtering Control policies via admin portal and cloud service API Adds Apple file types (keynote, numbers, pages) to the Other Documents category for File Type Control and DLP policies Adds Microsoft Hyper-V Hypervisor support for ZIA Virtual Service Edge virtual machines
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-12-02
Dec 2, 2022
· release notes
ZPA introduces ThreatLabZ controls for inspection and filtering capabilities in Web Inspection Diagnostics.
Enables ThreatLabZ predefined controls as an Inspection Control option in Zscaler Private Access to protect against confirmed CVEs and zero-day zero-day A vulnerability for which defenders have had no prior opportunity to apply a fix, often because it was previously unknown. A zero-day exploit takes advantage of that gap. vulnerabilities. Adds the ability to filter for ThreatLabZ controls within Web Inspection Diagnostics.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-11-29
Nov 29, 2022
· release notes
ZPA Admin Portal and API now support selecting the App Connector closest to the application.
Adds selectConnectorCloseToApp field to the ZPA API for controlling application segment connectivity Enables selection of the App Connector closest to the application via the ZPA Admin Portal
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-11-28
Nov 28, 2022
· release notes
ZPA adds ConnectionLogType custom field for App Connector Status logs and improved connector load balancing.
Adds the ConnectionLogType custom log field to the Log Streaming Service (LSS) when using the App Connector Status log type to distinguish between AppProtection and event logs Improves load balancing of application requests across App Connectors by accounting for CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. , memory, and UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port consumption using a probability mass function (PMF) algorithm
2 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2022) — 2022-11-28
Nov 28, 2022
· release notes
Private Service Edge 22.354.2 adds Platform as a policy criteria and multiple tenant Z-Tunnel support.
Adds Platform as a selectable criteria option for access policies, timeout policies, client forwarding policies, isolation policies, and inspection policies Enables configuration of multiple tenants when establishing Zscaler Tunnels (Z-Tunnels) between Zscaler Client Connector and a ZPA Public Service Edge or ZPA Private Service Edge
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-11-22
Nov 22, 2022
· release notes
ZPA now allows admins to configure disaster recovery targets for critical applications via the Admin Portal.
Client Connector — Client Connector App Release Summary (2022) — 2022-11-21
Nov 21, 2022
· release notes
Client Connector 3.7.1.38 adds Disaster Recovery options for unreachable ZIA and ZPA services.
Adds Disaster Recovery options when Zscaler Internet Access (ZIA) is not reachable Adds Disaster Recovery options when Zscaler Private Access (ZPA) is not reachable
2 details in Everything
Client Connector — ZDX Module Release Summary (2022) — 2022-11-15
Nov 15, 2022
· release notes
ZDX Module 3.5 for Windows adds remote packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capabilities and adjusts tunnel detection logic.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-11-14
Nov 14, 2022
· release notes
New App Connector and ZPA Private Service Edge OVAs with corrected VM specifications.
New OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. images for App Connector and ZPA Private Service Edge that correct the recommended memory and disk space settings to match the Help Portal documentation.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-11-11
Nov 11, 2022
· release notes
ZIA adds new cloud application risk profile attributes including WAF WAF A reverse proxy that inspects HTTP/HTTPS traffic and blocks requests matching known attack patterns such as SQL injection or XSS, sitting between clients and a web application to filter malicious input before it reaches the server. support, SPF SPF An email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. , DKIM DKIM An email authentication standard that lets a sending mail server cryptographically sign outgoing messages so receiving servers can verify the signature was not forged or tampered with in transit. , DMARC, and CVE vulnerability status.
Adds File Sharing , SSL Cert Key Size , Vulnerable to Heartbleed , Vulnerable to Poodle , Vulnerable to Logjam , Support for WAF , Remote Access Screen Sharing , Vulnerability Disclosure Policy , Sender Policy Framework , DomainKeys Identified Mail, and Domain-Based Message Authentication attributes to Cloud Application Risk Profiles under Administration > Risk Profiles > Add/Edit Cloud Application.
1 detail in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-11-11
Nov 11, 2022
· release notes
Zscaler Client Connector 3.21.2 adds per-device logging, Web 2.0 browser control, anti-tampering, and macOS firewall bypass settings.
Adds logs_per_device configuration option to enable device-specific log collection Enables the Web 2.0 web browser control via profile settings in Zscaler Client Connector Adds the ability to intercept ZIA traffic from any network adapter in the client profile Provides an anti-tampering solution for processes, services, files, and registry keys Supports configuring a preferred port for Zscaler Client Connector to SME server communication
+3 more
show less
Adds public API information entries in the Zscaler Client Connector Portal audit logs Allows disabling the Zscaler firewall for macOS when ZIA is active via profile settings Enables or disables exclusion DNS servers in the routing table for macOS via profile settings
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-11-10
Nov 10, 2022
· release notes
New ZPA App Connector and Private Service Edge images in AWS Marketplace and Azure Portal with PRA library enhancements.
App Connector and ZPA Private Service images available in AWS Marketplace for Privileged Remote Access (PRA) library enhancements New App Connector image available in Microsoft Azure Portal providing the same PRA library improvements
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-11-07
Nov 7, 2022
· release notes
ZIA adds support for fetching Admin Audit logs via NSS and Cloud NSS feeds
Enables retrieval of Branch Connector, Client Connector, ZDX, and ZIA Portal audit reports via NSS
1 detail in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-11-07
Nov 7, 2022
· release notes
Android 1.10 adds FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. support and iOS 1.9.1 fixes upgrade connectivity issues.
Adds FIPS compliance support for upcoming federal cloud environments in the Android Client Connector app (v1.10). Requires Android 13+ users to explicitly grant post-notification permissions during Zscaler service enrollment.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-11-04
Nov 4, 2022
· release notes
ZIA adds User Risk Report, Cyber Risk Report, OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API auth, intermediate CA certs, sandbox threat score customization, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. event logs, and Secure Browsing isolation.
Adds GET /adminRoles/lite with new includeApiRole query parameter to retrieve API roles for OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 client configuration Deprecates /sslSettings endpoints in favor of new /intermediateCaCertificate endpoints for managing intermediate CA certificates Adds GET /eventlogEntryReport, POST /eventlogEntryReport, DELETE /eventlogEntryReport, and GET /eventlogEntryReport/download endpoints to generate SCIM event log reports Adds /behavioralAnalysisAdvancedSettings endpoints (GET, PUT) and GET /behavioralAnalysisAdvancedSettings/fileHashCount to configure custom MD5 file hashes in sandbox policies Adds Insights Logs page under Administration to view recorded SCIM client activity
+10 more
show less
Adds Secure Browsing module in the Admin Portal containing the Smart Browser Isolation policy, moving Browser Control into it Adds User Risk Report page showing risk score based on user anomalies, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. violations, and risky behavior Adds Cyber Risk Report under Analytics for high-level visibility into organization's policy structure and posture Adds minimum threat score customization (40-70) in Sandbox Policy with AI Quarantine enabled Adds Support for Admin User Deletion Through SCIM setting in Administrator Management > Advanced Configuration Adds wildcard FQDN support as a criterion in Control Policies and Destination Groups, renaming IP Address or FQDN fields accordingly Adds Support for Custom File Hashes allowing MD5 hashes in sandbox advanced policy settings Adds new DLP predefined dictionaries: Fiscal Code (Italy) and Identity Card Number (Hong Kong) Adds Inspect Downloads option for Data Loss Prevention policy rules with content inspection Adds Cloud Applications criterion to the File Type Control rule
15 details in Everything
└──▷ BREAKING ON UPGRADE
! The MaxMind GeoIP GeoIP A database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. Legacy database is deprecated and replaced with MaxMind GeoIP2, affecting the ${COUNTRY} variable in PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files! The Advanced SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Settings tab is deprecated and replaced with a new Intermediate CA Certificates tab! The IP Address or FQDN field is renamed to IP Address or Wildcard FQDN in Firewall Filtering Policy, NAT Control Policy, and IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control rules! The Destination IP Address / FQDN field is renamed to Destination IP Address / Wildcard FQDN in Forwarding Control policy! The FQDN Domain type is renamed to Wildcard FQDN in Destination Groups! Browser Control policy has been moved to the Secure Browsing module
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-11-04
Nov 4, 2022
· release notes
Zscaler Cloud Connector Portal now supports separate API key management and multiple admin UI languages
API Key Exclusivity feature enables independent API keys for the Zscaler Cloud Connector Portal and the ZIA Admin PortalMultiple Language Support adds English, French, German, Japanese, Spanish, and Simplified Chinese to the Zscaler Cloud Connector Portal admin UI
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-11-03
Nov 3, 2022
· release notes
ZPA updates the default state of the session termination feature.
Client Connector — Client Connector App Release Summary (2022) — 2022-11-02
Nov 2, 2022
· release notes
Zscaler Client Connector 1.9 for iOS adds DNS forwarding via VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profile and per-app VPN status notifications.
Adds SystemDNSEnabled VPN profile setting to forward DNS to system settings Allows configuring a user notification option for per-app VPN tunnel establishment progress on iOS
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-10-31
Oct 31, 2022
· release notes
ZPA introduces new network service ports for NTP and Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. in its Admin Portal and allows duplicating inspection profiles via UI.
└──▷ BREAKING ON UPGRADE
! The endpoint to get details of all client types is deprecated
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-28
Oct 28, 2022
· release notes
ZIA adds Cloud Applications criterion to File Type Control rules and new Active Content/Unscannable file criteria.
Cloud Applications criterion added to the File Type Control ruleFile Type Control supports Active Content criterion for Microsoft Office and PDF formats File Type Control supports Unscannable Files criterion
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-10-28
Oct 28, 2022
· release notes
ZPA adds new certificate management and client type details APIs while deprecating legacy endpoints.
Updates certificate endpoints to use the certificate field instead of clientlessCertificate in request payloads Provides a new endpoint to retrieve details of all client types
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The clientlessCertificate field is replaced by certificate in certificate-related API request endpoints! Endpoints used to get all certificates or a particular certificate are deprecated and removed from the API Portal
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-10-28
Oct 28, 2022
· release notes
Zscaler Cloud Connector VMs on Azure now enable Accelerated Networking by default.
Private Access (ZPA) — App Connector Release Summary (2022) — 2022-10-27
Oct 27, 2022
· release notes
App Connector 22.284.3 adds CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage visibility to system logs.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-10-21
Oct 21, 2022
· release notes
ZDX 2022 adds time-point score comparison, visual states for probes/apps, and device timezone in hop view.
Adds ability to compare two time points in the ZDX Score Over Time graph on the user details page Updates UI to visually distinguish disabled (grey text) from deleted (strikethrough text) applications and probes in the Admin Portal Displays device profile time zone on hover within the Cloud Path Hop View
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-21
Oct 21, 2022
· release notes
ZIA adds Cloud HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. for intermediate CA, OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API auth, Smart Browser Isolation, Event Logs, and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. versioning
Adds Intermediate CA Certificates tab in Admin Portal and /intermediateCaCertificate API endpoints to configure multiple custom intermediate CA certificates with Cloud HSM or Software protection. Deprecates /sslSettings endpoints in favor of the new /intermediateCaCertificate resource for certificate management. Adds OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 Client Credentials flow support for API authentication using Administration > Role Management > Add API Role and Administration > Cloud Service API Security > OAuth 2.0 Authorization Servers. Updates GET /adminRoles/lite to support the new includeApiRole query parameter for managing API roles. Adds Secure Browsing module in Admin Portal for Smart Browser Isolation policy and moves Browser Control policy into this module.
+16 more
show less
Adds Cloud Application Instances feature allowing granular control based on instance identifiers in Cloud App Control and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies. Adds Cyber Risk Report under Analytics to evaluate organization posture against cyber threats. Adds predefined DLP dictionaries for Italian Fiscal Codes and Hong Kong Identity Card Numbers. Adds Inspect Downloads option for DLP policy rules with content inspection. Adds granular viewing/uploading actions (Allow, Block, Isolate) to System & Development cloud app control rules. Renames URL category Sexuality to Body Art . Allows custom minimum threat score configuration (40-70) for Sandbox policy AI Quarantine and adds new threat categories: Sandbox Offsec Tools , Sandbox Ransomware , Sandbox Suspicious . Adds support for new file types across Archive, Audio, Database, Executable, Image, Mac Documents, Media, Microsoft Office, Mobile, Online Gaming, Open Office Files, Other Documents, Source Code, Video, and Web Content categories in File Type Control and DLP. Adds support for admin user deletion actions via SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. in the Advanced Configuration section of Administrator Management. Adds /behavioralAnalysisAdvancedSettings endpoints (GET, PUT) and file hash counting endpoint to manage custom MD5 file hashes. Adds Event Logs page under Administration and /eventlogEntryReport API endpoints for SCIM client activity tracking. Enhances PAC file versioning with Export icon (text/PAC/JS), Preview Version Details page, Manage PAC File page, and expanded verification errors. Renames IP Address or FQDN field to IP Address or Wildcard FQDN in Firewall Filtering, NAT Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Forwarding Control policies, and Destination Groups. Deprecates MaxMind GeoIP GeoIP A database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. Legacy database in PAC files, replacing it with MaxMind GeoIP2 for the ${COUNTRY} variable. Adds new actions for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP Policy (CRM/ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. ) including Quarantine, Remove, Report Incident Only, and specific collaborator/link removal options. Adds Remove Malware action to SaaS Security API Malware Detection Policy for CRM and ITSM applications.
21 details in Everything
└──▷ BREAKING ON UPGRADE
! The /sslSettings endpoints (POST /sslSettings/generatecsr, GET /sslSettings/downloadcsr, GET /sslSettings/showcert, POST /sslSettings/uploadcert/text, POST /sslSettings/uploadcertchain/text, DELETE /sslSettings/certchain) are deprecated and replaced by the /intermediateCaCertificate resource.! The Advanced SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Settings tab in the ZIA Admin Portal is deprecated and replaced with the Intermediate CA Certificates tab.! The IP Address or FQDN field is renamed to IP Address or Wildcard FQDN in Firewall Filtering Policy, NAT Control Policy, IPS Control rule, Forwarding Control rule, and Destination Groups.! The MaxMind GeoIP Legacy database is deprecated and replaced with MaxMind GeoIP2; the ${COUNTRY} variable in PAC files must now use countries listed on GeoNames.! The URL category Sexuality is renamed to Body Art .
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-10-21
Oct 21, 2022
· release notes
Cloud & Branch Connector adds multiple language support for the admin portal and separates API keys from ZIA
Enables separate management of the Zscaler Cloud Connector Portal API key from the Zscaler Internet Access (ZIA) Admin Portal
1 detail in Everything
Deception — Release Upgrade Summary (2022) — 2022-10-20
Oct 20, 2022
· release notes
Zscaler Deception adds OAS 3.0 API support with programmatic deployment and IP allowlist bulk options via UI.
Adds support for OpenAPI OpenAPI A vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. Specification version OAS 3.0.0 for Orchestrate, Miragemaker, Deceive, Landmine, Investigate, and Settings features to programmatically configure and deploy decoys Adds ability to allow all IP addresses to access a particular module via the Allowed IPs page (Settings > Network Settings > Allowed IPs) in the Zscaler Deception Admin Portal Adds viewing of bookmark folder names for Google Chrome and Mozilla Firefox favorite lures on the Policy Preview page for a landmine agent
3 details in Everything
└──▷ BREAKING ON UPGRADE
! The Connectors and Integrations tabs on the SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. page (Orchestrate > SIEM) are removed and replaced with SIEM Connectors (Orchestrate > SIEM Connectors) and SIEM Integrations pages (Orchestrate > SIEM Integrations)
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-10-20
Oct 20, 2022
· release notes
Increases limits for configurable applications and application segments in Zscaler Private Access.
Client Connector — Client Connector App Release Summary (2022) — 2022-10-20
Oct 20, 2022
· release notes
Client Connector 4.0 for Windows adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. notifications, ZIA posture profiles, PKCE PKCE Proof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. enrollment, and DR options
Adds Data Loss Prevention notifications visible in the client. Adds External Device ID value in Device Details. Provides separate one-time passwords (OTPs) for logout and uninstall functions. Adds support for posture-based risk profiles for Zscaler Internet Access (ZIA). Provides Disaster Recovery options when ZIA is not reachable.
+2 more
show less
Provides Disaster Recovery options when ZPA is not reachable. Supports dropping inbound access to Client Connector listening ports in packet filter mode.
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-14
Oct 14, 2022
· release notes
ZIA adds cloud app criterion to File Type Control, HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. -backed intermediate CA management via new API endpoints, and ZPA Application Segment support in policies and dashboards
/intermediateCaCertificate endpoints added for managing intermediate CA certificates with software or Cloud HSM protectionCloud Applications criterion added to File Type Control rules to match specific cloud apps or classesActive Content and Unscannable Files criteria added to File Type Control rulesZPA Application Segment criterion added to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Firewall Filtering, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Sandbox, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection, and File Type Control policiesTop Application Segments widget and Application Segment data type added to Firewall and Web dashboard widgets
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The /sslSettings cloud service API endpoints are deprecated in favor of /intermediateCaCertificate endpoints; the Postman collection has been updated accordingly.! The Advanced SSL Inspection Settings tab in the ZIA Admin Portal is replaced with the Intermediate CA Certificates tab.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-10-10
Oct 10, 2022
· release notes
ZPA updates Private Service Edge log correlation, CLI version display, and PRA/DSD FQDN mapping
Adds correlation of journal logs between ZPA Private Service Edges and Zscaler Client Connector, Machine Tunnels, and App Connectors Enables the Manager software command line interface to display the Manager software version Allows Privileged Remote Access (PRA)-enabled applications using SSH or RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. consoles to connect when Dynamic Server Discovery (DSD) is turned off by mapping to a server with an FQDN
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-10-08
Oct 8, 2022
· release notes
Adds a Force Authentication option for IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configuration in Zscaler Private Access
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-07
Oct 7, 2022
· release notes
ZIA adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. API auth, Secure Browsing module, wildcard FQDNs, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. admin deletion, custom file hashes, and new insights filters.
Adds GET /ipv6config, GET /ipv6config/dns64prefix, GET /ipv6config/nat64prefix, GET /ipSourceGroups/ipv6SourceGroups, GET /ipDestinationGroups/ipv6DestinationGroups endpoints to configure and retrieve IPv6 settings, prefixes, and address groups via the cloud service API. Adds organization-level IPv6 enablement at Administration > IPv6 Configuration and per-location Enable IPv6 + DNS64 Prefix settings for forwarding IPv6 traffic over IPv4 tunnels. Adds new Firewall Filtering Rule Block All IPv6 created automatically when IPv6 support is enabled to block all IPv6 traffic by default. Adds IPv6 address support to predefined and custom URL categories via Custom URLs and URLs Retaining Parent Category options in Administration > URL Categories. Adds new NSS feed fields %s{cip}, %s{cintip}, %s{sip} for Web logs, %s{csip}, %s{cdip}, %s{sdip}, %s{ssip} for Firewall logs, and %s{cip}, %s{sip}, %s{res}, %s{restype} for DNS logs to include IPv6 addresses.
+27 more
show less
Removes field %s{cltipv6} from NSS feeds for web logs and removes Client IPv6 option from Web Insights Logs filters/columns in favor of standard IP fields. Adds OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 authentication support using Client Credentials flow with external providers (PingFederate, Okta, Azure AD) for secure API access. Adds administration under Administration > Role Management > Add API Role to configure API roles that define client application permissions for API authentication. Adds configuration path Administration > Cloud Service API Security > OAuth 2.0 Authorization Servers to add and manage authorization servers for verifying JWTs JWTs JSON Web Tokens — an open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object. Cyber tools use them for stateless authentication without server-side session storage. in API requests. Updates the GET /adminRoles/lite endpoint with a new includeApiRole query parameter. Adds Caution button to Policy > URL & Cloud App Control > Cloud App Control Policy > Add rule page to caution users before allowing access to specific cloud applications. Enables granular action-specific controls for System & Development cloud app rules: Viewing (Allow/Block/Isolate) and Uploading (Allow/Block). Adds Inspect Downloads option for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policy rules with content inspection to enable DLP inspection on downloaded content from specific cloud apps. Adds new predefined DLP dictionaries for Italian Fiscal Codes and Hong Kong Identity Card Numbers. Adds new categories Mac Documents, Media, and Open Office Files to File Type Control and DLP policies. Adds Secure Browsing module in the Admin Portal for Smart Browser Isolation policy configuration; moves Browser Control policy into this module. Adds Cyber Risk Report (Analytics > Cyber Risk Report) providing high-level visibility into policy structure, risk scores, and posture against emerging cyber threats. Adds Cloud Application Instances feature using instance identifiers for granular control of actions in Cloud App Control and DLP policies based on domain types. Adds support for custom MD5 file hashes in sandbox advanced policy settings via GET /behavioralAnalysisAdvancedSettings, PUT /behavioralAnalysisAdvancedSettings, GET /behavioralAnalysisAdvancedSettings/fileHashCount endpoints. Adds Event Logs page under Administration to list SCIM client activity and API endpoints GET/POST/DELETE /eventlogEntryReport and GET /eventlogEntryReport/download to generate and download event log reports. Adds advanced configuration setting for future action taken against an admin account when deleted via SCIM, found in the Advanced Configuration section of Administrator Management page. Enhances PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file versioning: adds Name, Number of Hits, Currently Deployed Version columns; Export icon for text/PAC/JS formats; Preview Version Details and Manage PAC File pages for version comparison and management; supports up to 10 versions per file (limit 256 default, 1024 on request); updates verification library for broader JS error capture. Adds Audit Logs actions: Change Deployed PAC Version, Create New PAC Version, Delete PAC, Delete PAC Version, Stage PAC Version. Adds Risk Index Override capability to alter Zscaler-computed risk index values for cloud applications on the Application Information page. Adds Subcloud Management feature in ZIA Admin Portal to view/edit subclouds and temporarily disable data centers during maintenance or incidents. Enables wildcard FQDNs as a policy criterion and destination group; renames IP Address or FQDN fields to IP Address or Wildcard FQDN in Firewall Filtering Policy, NAT Control Policy, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, and Forwarding Control tabs; renames FQDN Domain type to Wildcard FQDN in Destination Groups. Deprecates MaxMind GeoIP GeoIP A database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. Legacy database for PAC files and replaces with MaxMind GeoIP2; updates ${COUNTRY} variable usage. Updates Firewall Insights Logs to use new Blocked by Web Proxy Policy firewall filtering rule to indicate sessions handled by the web proxy. Adds CRM and ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. applications to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Control Policies for DLP actions (Read Only, Quarantine, Remove, Report Incident Only) and Malware Detection (Remove Malware). Adds Confluence, Jira Software, and Bitbucket support for SaaS Security API tenants, control policies, scan schedules, Assets Summary/Assets Reports, Insights & Insights Logs, and NSS Feeds. Adds Bitbucket support for SaaS Security Posture Control policy and report. Adds Client SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Handshake Failure Reason and Client SSL Handshake Failure Aggregate Count filters/columns to Web Insights Logs; adds %s{cltsslfailreason} and %d{cltsslfailcount} fields to NSS feed outputs for web logs.
32 details in Everything
└──▷ BREAKING ON UPGRADE
! Field %s{cltipv6} is removed from NSS feeds for web logs.! Client IPv6 option is removed from Web Insights Logs filters and columns.! MaxMind GeoIP Legacy database is deprecated and replaced with MaxMind GeoIP2; the ${COUNTRY} variable usage must be updated accordingly.
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-10-07
Oct 7, 2022
· release notes
Cloud & Branch Connector now supports separate API keys for Cloud Connector and ZIA portals, plus multi-language portal support.
API key is now exclusive to the Zscaler Cloud Connector Portal and no longer shared with the Zscaler Internet Access (ZIA) Admin Portal Admins can now display the Zscaler Cloud Connector Portal in multiple languages: English, French, German, Japanese, Spanish, or Simplified Chinese
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-02
Oct 2, 2022
· release notes
ZIA adds EDM template indexing failure notifications for duplicate primary key limits.
Adds a notification in the ZIA Admin Portal when an EDM template exceeds the 2048 duplicate primary key limit
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-10-01
Oct 1, 2022
· release notes
ZIA adds EDM Indexing Failed Schemas notification for duplicate primary key limits
Sets error status with primary key limit error type in the Index Tool for templates exceeding the limit.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-30
Sep 30, 2022
· release notes
ZIA adds API authentication via OAuth 2.0 OAuth 2.0 An open authorization framework (IETF RFC 6749) that lets a service grant limited API access to a third party without sharing credentials, giving cyber tools a standard way to authenticate against external platforms. Client Credentials flow with new Admin Portal configurations and GET /adminRoles/lite parameter
Adds GET /adminRoles/lite endpoint support for the includeApiRole query parameter to include API role details in responses Adds new Add API Role page under Administration > Role Management in the ZIA Admin Portal to define client application permissions for the Cloud Service API Adds OAuth 2 OAuth 2 An open authorization framework (RFC 6749) that lets a service grant limited access to a user's resources on another service without exposing credentials, giving cyber tools a standard way to authenticate against third-party APIs. .0 Authorization Servers configuration section under Administration > Cloud Service API Security to verify access token access token A credential that authorizes a client to use a service or API. It usually has limited permissions and a lifetime; anyone holding it may be able to use those permissions. authenticity for API requests
3 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-09-30
Sep 30, 2022
· release notes
Adds public API for enrolled devices CSV download, iOS default browser auth, and new Linux posture types.
Adds a public API to download enrolled devices information as a CSV file. Supports authentication using the default browser for iOS. Supports disabling and enabling Zscaler Client Connector proxies on VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. adapters. Supports adding Zoom and Microsoft Teams bypass IPs to VPN Gateways. Supports the Detect Microsoft Defender posture type for Linux.
+2 more
show less
Supports the OS Version posture type for Linux. Supports the Full Disk Encryption posture type for Linux.
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-27
Sep 27, 2022
· release notes
ZPA adds Intelligent Application Segmentation with recommended segments in the Admin Portal
Introduces Intelligent Application Segmentation feature that recommends application segments to add to existing defined segments
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-24
Sep 24, 2022
· release notes
ZIA adds duplicate primary key limit notifications for EDM templates
Displays an EDM Indexing Failed Schemas notification in the ZIA Admin Portal when an EDM template exceeds the 2048 duplicate primary key limit.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-09-23
Sep 23, 2022
· release notes
ZDX adds Software and Device Inventory views and settings to track software versions and device/user associations.
Adds Software Inventory view under the Inventory menu to show current and historical software versions on user devices Adds Device Inventory view under the Inventory menu to show current device information and associated users Adds Inventory Data Collection toggle in Inventory Settings under the Administration menu to enable inventory data ingestion
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-23
Sep 23, 2022
· release notes
ZIA adds Secure Browsing module, Cyber Risk Report, Event Logs API endpoints, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file versioning and wildcard FQDN support.
Adds Secure Browsing module to the Policy section for Smart Browser Isolation and moves Browser Control policy into it Adds Cyber Risk Report under Analytics with a risk score evaluating policy configuration, traffic patterns, and feature capabilities Adds two new predefined DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries: Fiscal Code (Italy) and Identity Card Number (Hong Kong) Adds Inspect Downloads option for DLP policy rules with content inspection to inspect downloaded content from specific cloud applications Adds minimum threat score customization (40-70) in Sandbox Policy with new categories: Sandbox Offsec Tools , Sandbox Ransomware , Sandbox Suspicious
+10 more
show less
Adds Event Logs page and four new API endpoints for SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. activity logs: GET /eventlogEntryReport, POST /eventlogEntryReport, DELETE /eventlogEntryReport, GET /eventlogEntryReport/download Adds PAC file versioning with Export (text, PAC, JS), Preview Version Details page, and Manage PAC File page with version comparison Adds Support for Admin User Deletion Through SCIM in the Advanced Configuration section of Administrator Management Adds Subclouds feature to view/edit subclouds and temporarily disable specific data centers Adds Support for Wildcard FQDN in Control Policies & Destination Groups, renaming fields like IP Address or FQDN to IP Address or Wildcard FQDN Adds Support for Risk Index Override on the Application Information page for cloud applications Adds MIP labels support in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API DLP Policy for file sharing applications (OneDrive/SharePoint tenants) Updates Country variable in PAC Files to use MaxMind GeoIP2 database replacing MaxMind GeoIP GeoIP A database that maps IP addresses to geographic locations; tools use it to attribute traffic or alerts to countries, cities, or ASNs without querying external services. Legacy Renames URL category Sexuality to Body Art Ends support for Microsoft Internet Explorer
15 details in Everything
└──▷ BREAKING ON UPGRADE
! MaxMind GeoIP Legacy database is deprecated and replaced with MaxMind GeoIP2; the ${COUNTRY} variable in PAC files now uses GeoNames data! The URL category Sexuality is renamed to Body Art ! Microsoft Internet Explorer is no longer supported
Client Connector — Release Upgrade Summary (2022) — 2022-09-23
Sep 23, 2022
· release notes
Adds public API for enrolled devices CSV export; adds Linux posture types; iOS browser auth and VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. adapter proxy control.
Adds a public API to download enrolled devices information as a CSV file Supports the Detect Microsoft Defender posture type for Linux Supports the OS Version posture type for Linux Supports the Full Disk Encryption posture type for Linux Supports disabling and enabling Zscaler Client Connector proxies on VPN adapters
+5 more
show less
Supports authentication using the default browser for iOS Allows administrators to configure an option to notify users that per-app VPN tunnel establishment is in progress for iOS devices Supports a test mode for disaster recovery for selected app profiles Updates the range of the value you can enter for MTU for Zscaler Adapter to between 800 and 1400 Supports adding Zoom and Microsoft Teams bypass IPs to VPN Gateways
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-22
Sep 22, 2022
· release notes
ZIA enables concurrent browser isolation sessions per device/browser window type across zscaler platforms.
Enables users to access multiple active Cloud Browser Isolation sessions simultaneously on the same device, provided they are in different browser window types (e.g., Chrome and Firefox).
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-22
Sep 22, 2022
· release notes
ZPA adds validation messages for invalid special characters in Cloud Browser Isolation isolation profile names.
Cloud Browser Isolation Portal now displays a validation message clarifying which character symbols are invalid when configuring or editing ZPA isolation profiles.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-20
Sep 20, 2022
· release notes
ZPA adds TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Quick Acknowledgement support for App Connector Groups via UI and API fields
Enables TCP Quick Acknowledgement option for App Connector Groups in the ZPA Admin Portal Adds new API fields to set TCP Quick Acknowledgement at the App Connector Group level
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-19
Sep 19, 2022
· release notes
ZPA adds WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. inspection control and shows App Connector platform details in Admin Portal.
Adds WebSocket as an Inspection Control option for Application Segments. Shows App Connector platform (AWS, Azure, ESXi, Docker, Nutanix) details in App Connector Status Diagnostics and the App Connectors page.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The Provisioning Key Utilization Count column has been removed from the Machine Provisioning Keys page.! The Maximum Reuse of Key section in the Add and Edit windows for a Machine Provisioning Key has been removed.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-16
Sep 16, 2022
· release notes
ZIA adds Active Content and Unscannable Files criteria to file type control policies.
Adds Active Content criterion for file type control rules (applicable to Microsoft Office and PDF formats only) Adds Unscannable Files criterion for file type control rules
2 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-09-16
Sep 16, 2022
· release notes
New public API for enrolled devices CSV export, per-app VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. notifications for iOS, and Linux posture types.
Adds a public API to download enrolled devices information as a CSV file Allows administrators to configure an option to notify users that per-app VPN tunnel establishment is in progress for iOS devices Supports the Detect Microsoft Defender posture type for Linux Supports the OS Version posture type for Linux Supports the Full Disk Encryption posture type for Linux
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-14
Sep 14, 2022
· release notes
ZPA adds Interactive Authentication for privileged consoles and Any as a Connection Security option for app segments
Enables Interactive Authentication for privileged consoles in the Privileged Remote Access portal, allowing users to log in via pop-up windows for Windows NLA or SSH keys Adds Any as a selectable value for the Connection Security option when configuring an Application Segment
2 details in Everything
Deception — Release Upgrade Summary (2022) — 2022-09-12
Sep 12, 2022
· release notes
Zscaler Deception 4.14 adds Sandbox integration, Windows Defender containment, endpoint deception via Client Connector, LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. detection, log export, and unified decoy licensin
Native integration with Zscaler Sandbox allows sending evidence to enrich attack information with threat intelligence and generate detailed Indicators of Compromise (IOC IOC An indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. ) reports. Threat Containment Integration with Microsoft Windows Defender enables automating or manually sending block requests to isolate infected endpoints via orchestration rules in the Zscaler Deception Dashboard. Endpoint Deception support for users running Zscaler Client Connector 3.9 or later, enabling deception capabilities on endpoints without separate installation. LDAP Detection Support to detect high-fidelity LDAP activity on endpoints. Export Agent Logs from Endpoints capability to expedite troubleshooting of active endpoint agents.
+1 more
show less
Unified decoy licensing system that aggregates Network, Active Directory Active Directory Microsoft's directory service for Windows networks that centralises authentication and authorisation; cyber tools target or integrate with it because it controls identity and access across most enterprise environments. , and Private Threat Intelligence licenses into a single pool for any use case.
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-08
Sep 8, 2022
· release notes
ZPA Admin Portal adds Events and Notifications management and Diagnostics Event logs
Adds Administration > Notifications area in ZPA Admin Portal to add, view, and filter event notifications Adds visible Event logs on the Diagnostics page under the Events log type
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-07
Sep 7, 2022
· release notes
ZIA adds Zscaler Deception SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. policy option and granular System & Development cloud app control actions.
Adds Zscaler Deception under Policy in the ZIA Admin Portal for single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access to the Zscaler Deception Admin Portal Grants granular action options (Viewing: Allow/Block/Isolate; Uploading: Allow/Block) for System & Development cloud app control rules
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-09-06
Sep 6, 2022
· release notes
ZPA Private Access adds TLS encryption support for Log Streaming Service with custom CA-signed certificates.
Adds TLS Encryption for LSS Traffic with Self-Signed Certificates capability to allow Log Streaming Service traffic to use certificates signed by a custom certificate authority Adds support for VMware's Unified Access Gateway (UAG) for use with Browser Access
2 details in Everything
Private Access (ZPA) — App Connector Release Summary (2022) — 2022-09-06
Sep 6, 2022
· release notes
App Connector 22.228.5 adds custom CA TLS for Log Streaming, VMware UAG support, and RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. NLA
App Connectors now support TLS encryption for Log Streaming Service (LSS) traffic with certificates signed by a custom root certificate authority (CA) Added support for VMware’s Unified Access Gateway (UAG) Added support for mandatory RDP Network Level Authentication regarding Privileged Remote Access (PRA) connections Added support for AppProtection for Private Application Traffic using the WebSocket WebSocket A protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. communication protocol App Connector Status Diagnostics and the App Connector page now expose platform and host OS details
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-09-02
Sep 2, 2022
· release notes
ZIA adds Security Alerts console with webhook integration and User Risk Profile policy criteria
Adds the Security Alerts feature in the ZIA Admin Portal to view, manage, and adjust alert rules with high-level statistics and threat severity views Enables creating webhooks to deliver Security Alerts events to third-party applications such as ServiceNow and Splunk Adds User Risk Profile (Low, Medium, High, Critical) as a configurable criterion in Cloud App Control, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. with/without Content Inspection, and URL Filtering policies Introduces the Blocked by Web Proxy Policy firewall filtering rule in Firewall Insights Logs to indicate sessions handled by the web proxy
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-29
Aug 29, 2022
· release notes
Adds inline web DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. support for Microsoft Information Protection (MIP) labels via a new MIP Labels page and dictionary type
Adds a new Administration > Microsoft Information Protection (MIP) Labels page to manage MIP accounts and view associated labels Adds a new Microsoft Information Protection (MIP) dictionary type for DLP policies, accessible via Administration > DLP Dictionaries & Engines > Add DLP Dictionary
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-08-29
Aug 29, 2022
· release notes
SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API field ID formats changed to UUID UUID A universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. ; SCIM Sync Logs add Internal Entity ID column and search option
SCIM id, userId, and groupId fields now use UUID format in responses SCIM Sync Logs table adds an Internal Entity ID column SCIM screens add a new search option for Internal Entity ID on users and groups
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-26
Aug 26, 2022
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Application Tenant Onboarding for Google Workspace, Third-Party Applications Report, customizable Minimum Threat Score in Sandbox, and a new User Risk Report pa
Adds ability to discover, allow, and block third-party SaaS applications authenticated via corporate Google account by adding Google Workspace Marketplace as a tenant in the ZIA Admin Portal Adds Third-Party Applications Report to display all third-party applications discovered via corporate Google Workspace accounts with discovery date and usage stats Adds configurable Minimum Threat Score (40-70) in Sandbox Policy to control file download behavior under AI Quarantine, with default value 40 Adds new Sandbox Rules categories: Sandbox Offsec Tools , Sandbox Ransomware , and Sandbox Suspicious for policy configuration Adds Sandbox Offensive Security Tools , Sandbox Ransomware , and Suspicious to the Threat Category filter in Web and Mobile Insights Logs pages
+1 more
show less
Adds User Risk Report page to monitor organization risk exposure from a user perspective based on anomalies, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. violations, and suspicious behavior
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-08-26
Aug 26, 2022
· release notes
Cloud & Branch Connector admins can now set Location scope to None when creating new locations.
Adds None as a selectable value for the Location scope in the Add Cloud Connector Admin window.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-08-23
Aug 23, 2022
· release notes
ZPA adds arbitrary domain IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support, bulk delete for disconnected connectors, config warnings, and session ID removal.
Adds Arbitrary Domains option when configuring an IdP for single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. to allow third-party users to use any authentication domain for clientless access Adds ability to disable configuration warnings for application segments in the Admin Portal via the new Setting Application Segment Configuration Warnings interface Adds bulk delete capability for disconnected App Connectors on the App Connectors page using the Disconnected filter
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Session ID field is removed from the Client Sessions and Audit Logs pages in the Admin Portal
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-08-19
Aug 19, 2022
· release notes
ZDX introduces granular permission controls for Help Desk roles in its cloud service. Administrators can now assign specific permissions levels and configure obfuscation settings to hide sensitive information via the Add ZDX Role interface.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-19
Aug 19, 2022
· release notes
ZIA adds HTTP/2 support with admin portal controls and Web Insights log filters.
Adds Administration > Advanced Settings toggle to set HTTP/2 as the default web protocol for organizational application access. Enables HTTP/2 via the Action section under Policy > SSL Inspection > Add SSL Inspection Rule. Adds Response HTTP Version and Request Version as new data types, columns, and filters in Analytics > Web Insights > Logs.
3 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-08-19
Aug 19, 2022
· release notes
Client Connector 3.7 adds native IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. , Split VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. binding, browser-based ZPA reauth, and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. fallback options.
Adds native IPv6 support Adds the Fallback to Gateway Domain option to use when PAC proxies cannot be reached for Z-Tunnel 1.0 Provides support for browser-based authentication for ZPA reauthentication on existing logged devices Supports configuring how Zscaler Client Connector works in tunnel mode by binding to the default adapter or by binding to a specific interface to support Split VPN (exclude routes) Supports configuring how Zscaler Client Connector detects trusted networks by sending the DNS requests through the default adapter
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Zscaler Client Connector MacOS 3.7 can no longer be updated and installed on devices running macOS Mojave 10.14
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-08-15
Aug 15, 2022
· release notes
ZDX adds native integration with ServiceNow Incident Management to auto-create incidents on alerts.
Adds ServiceNow Incident Management integration to ZDX for automatic incident creation upon alert triggers Supports webhook configuration for connecting ZDX alerts to ServiceNow
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-08-12
Aug 12, 2022
· release notes
ZDX adds alert status viewing, reduced default probe packet count, and time-range analysis for poor scores.
Adds ability to view alert statuses on the Alerts page Updates default packet count for new cloud path probes to 5 (predefined and custom applications) Enables Time Range Analysis for Poor ZDX Scores via Analyze Range in the user details graph
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-12
Aug 12, 2022
· release notes
ZIA adds Cyber Risk Report in Analytics; renames MCAS Unsanctioned Apps category
Adds the Cyber Risk Report under Analytics > Cyber Risk Report, providing a risk score based on policy configuration, traffic patterns, and feature capabilities against Zscaler best practices. Renames the custom URL category previously named MCAS Unsanctioned Apps to MS Defender Unsanctioned Apps for users integrating with Microsoft Cloud App Security.
2 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-08-10
Aug 10, 2022
· release notes
Adds browser-based authentication support to Client Connector app version 1.8.8 for iOS
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-08-09
Aug 9, 2022
· release notes
ZIA adds bookmarking in Cloud Browser Isolation and a per-profile Read-Only Mode setting.
Users can now access bookmarks from their original browser while in an isolated session; shared URLs redirect to appear as non-isolated. Admins can enable Read-only Mode per isolation profile to restrict keystrokes (text entry, paste) while allowing navigation keys.
2 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-08-05
Aug 5, 2022
· release notes
Zscaler Cloud & Branch Connector adds GWLB support in AWS via new CloudFormation CloudFormation An AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. and Terraform templates
Adds support for deploying Zscaler Cloud Connectors with Amazon Web Services Gateway Load Balancer (GWLB) for horizontal scalability and fault tolerance. Provides new GWLB templates for CloudFormation and configurations for Terraform to automate deployment.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-07-29
Jul 29, 2022
· release notes
ZIA adds cloud app criterion to File Type Control, AWS support to Tenant Profiles, and wildcard FQDNs across control policies.
Adds Cloud Applications selection as a criterion in File Type Control rules Extends Tenant Profiles feature to support Amazon Web Services account IDs Enables Wildcard FQDN configuration in Firewall Filtering, NAT Control, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control, Forwarding Control, and Destination Groups
3 details in Everything
Client Connector — ZDX Module Release Summary (2022) — 2022-07-19
Jul 19, 2022
· release notes
ZDX Module 3.4 improves proxy detection logic and reduces upload delay.
Improves Zscaler Digital Experience (ZDX) proxy detection by using all specific proxies for the selected domain in the app profile. Adds improvements to reduce the upload delay duration for Zscaler Client Connector.
2 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-07-19
Jul 19, 2022
· release notes
Client Connector 3.9 adds Z-Tunnel fallbacks, VDI VDI Virtual Desktop Infrastructure: a model where desktop operating systems run as VMs on a central server and stream to thin clients, giving cyber tools a single managed environment to monitor or scan. /posture support, deception integration and version rollback.
Enables configuring fallback options on Z-Tunnel 2.0 establishment failure Supports non-persistent VDI support changes Adds a customizable list of VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Trusted Network names for accurate detection Supports skipping trusted network criteria evaluation for Split VPN Trusted Network detection Supports running Zscaler Client Connector installs on Amazon Workspaces
+5 more
show less
Allows assigning specific entitlements to devices based on posture Integrates Zscaler Deception with Zscaler Client Connector Adds the ability to revert Zscaler Client Connector to the previously installed version Adds the option Fallback to Gateway Domain for PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. proxy failures in Z-Tunnel 1.0 Supports Certificate Trust and Client Certificate posture types for pre-Windows login machine tunnel
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-07-15
Jul 15, 2022
· release notes
ZIA adds cloud app instance control, custom IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. signatures, SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. admin deletion, and event log APIs
Adds Caution button to Cloud App Control policy rules to issue EUNs before allowing access Introduces Cloud Application Instances feature for granular action control via instance identifiers Adds Document Type filter and columns to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Insights Logs and SaaS Assets Report Expands NSS Feed Web Logs fields to include upload_filetype, upload_filename, upload_filesubtype, and upload_fileclass Enables File Type Control and DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. policies for Mac Documents, Media, and Open Office Files categories
+8 more
show less
Adds Advanced Configuration setting in Administrator Management to define future actions for admin accounts deleted via SCIM Adds Custom IPS > Custom Signature Rules page to create Snort-based inline intrusion protection rules Adds Custom IPS > Threat Categories page to define and associate custom threat categories with IPS rules Adds Show Only Custom Signature Rules filter and IPS Custom Signature column to Firewall Insights Logs Adds Custom Signature Rule and Custom Threat Category sub-categories to Administration > Audit Logs Adds %d{ips_custom_signature} field for NSS feed output of firewall logs Adds Event Logs page under Administration to list SCIM client activity Adds GET /eventlogEntryReport, POST /eventlogEntryReport, DELETE /eventlogEntryReport, and GET /eventlogEntryReport/download endpoints to the cloud service API
13 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-07-15
Jul 15, 2022
· release notes
Adds ID fields to audit logs, Fallback to Gateway Domain for Z-Tunnel 1.0, RBA RBA Risk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold. for support access, posture-based entitlements, Deception integration, and version revert.
Adds ZscalerInternetAccessId and ZscalerPrivateAccessId fields to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. audit logs when streaming traffic data from ZIA or ZPA Provides visibility into traffic bypassed from ZIA via new log fields Adds Fallback to Gateway Domain option in Zscaler Client Connector Profiles for Z-Tunnel 1.0 when PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. proxies are unreachable Supports using read and read/write roles in the API token for CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations Supports role-based access (RBA) to provide Zscaler Support remote assistance access to the portal
+3 more
show less
Supports assigning specific entitlements to devices based on posture via Device Groups Supports reverting Zscaler Client Connector to the previously installed version Adds support for Zscaler Deception integration with Zscaler Client Connector
8 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-07-15
Jul 15, 2022
· release notes
Client Connector adds ChromeOS browser-based auth support
Client Connector — Client Connector App Release Summary (2022) — 2022-07-11
Jul 11, 2022
· release notes
Client Connector for Android 1.9.1.16 adds browser-based authentication support
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-07-08
Jul 8, 2022
· release notes
ZIA adds Intermediate CA HSM HSM A tamper-resistant device that generates and stores cryptographic keys and performs operations with them, so the private key never leaves the hardware. Cloud KMS services run on fleets of them. support, new /intermediateCaCertificate API endpoints, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. versioning, and Secure Browsing isolation
Adds Cloud HSM protection type for intermediate CA certificates, allowing up to 8 cloud-certificates per tenant. Adds /intermediateCaCertificate API endpoints (e.g., POST /intermediateCaCertificate, GET /intermediateCaCertificate) to manage multiple intermediate CA certificates. Deprecates /sslSettings endpoints in favor of the new /intermediateCaCertificate API. Adds Intermediate CA Protection Type column and filter, plus new SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Policy Reason actions (e.g., Not inspected because of HSM error ) to Web Insights Logs. Introduces %s{keyprotectiontype} field for NSS web logs.
+12 more
show less
Adds Newly Revived Domains URL category to the Security super-category. Adds Secure Browsing module with Smart Browser Isolation policy using AI/ML models in the Admin Portal. Supports custom MD5 file hashes in sandbox advanced policy settings via GET and PUT /behavioralAnalysisAdvancedSettings API endpoints. Adds PAC file versioning UI: Hosted PAC Files table columns (Number of Hits , Currently Deployed Version ), Export icon (text, PAC, JS), Preview Version Details page, and Manage PAC File page. Increases max PAC files per organization to 256 (default) or 1024 (via support request). Adds new Audit Log actions for PAC management: Change Deployed PAC Version , Create New PAC Version , Delete PAC , Delete PAC Version , Stage PAC Version . Adds Subcloud Management page in Admin Portal to edit subclouds and temporarily disable data centers. Renames URL category Sexuality to Body Art . Adds Bypassed Transaction Event Time , Flow Type , Bypassed Transaction filters/columns to Web Insights Logs. Adds Bypassed Session Event Time , Flow Type , Bypassed Session filters/columns to Firewall Insights Logs. Adds %d{bypassed_traffic}, %s{bypassed_etime}, %s{flow_type} fields for NSS web logs. Adds %d{bypassed_session}, %s{bypass_etime}, %s{flow_type} fields for NSS firewall logs.
17 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-07-08
Jul 8, 2022
· release notes
Adds ZIA/ZPA ID fields to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. audit logs, Fallback to Gateway Domain for PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. , and Device Posture Entitlements.
Adds id fields for Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) to audit logs streaming to SIEM Adds the Fallback to Gateway Domain option in Zscaler Client Connector Profiles for Z-Tunnel 1.0 when PAC proxies are unreachable Supports assigning specific entitlements to devices based on posture via Device Groups and Zscaler Entitlement settings
3 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-07-01
Jul 1, 2022
· release notes
Zscaler Client Connector 3.21 adds ZIA/ZPA audit ID fields, PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. fallback domain, API CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. roles, RBA RBA Risk-Based Authentication, an approach that adjusts login challenge strength based on contextual signals like location or device, letting cyber tools step up verification only when anomaly scores cross a threshold. for Support, device entitlements by posture, Deception integration, and v
Adds id fields for ZIA and ZPA to SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. audit log streams Adds Fallback to Gateway Domain option in profiles for PAC proxy unavailability in Z-Tunnel 1.0 Supports read and read/write roles in API tokens for CRUD operations Supports role-based access (RBA) for Zscaler Support via Remote Assistance Supports assigning device entitlements based on posture
+2 more
show less
Supports Zscaler Deception integration Allows reverting to the previously installed version of Client Connector
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-06-24
Jun 24, 2022
· release notes
ZIA adds Security Alerts console with automated MFA MFA Multi-factor authentication, requiring proof from different categories, such as a password and a hardware key, to sign in. It reduces reliance on a password alone. /logout responses and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. tenant onboarding for Google Workspace
Adds a centralized Security Alerts console in the ZIA Admin Portal for viewing, managing, and creating alert rules with statistics by severity. Enables automated risk reduction via Security Alerts by logging users out or forcing Multi-factor Authentication (MFA) upon triggering suspicious events. Adds SaaS Application Tenant Onboarding to discover, allow, or block third-party SaaS applications authenticated via corporate Google accounts after adding Google Workspace Marketplace as a tenant. Adds a Third-Party Applications Report in the ZIA Admin Portal displaying discovered Google Workspace apps, employee usage counts, and discovery dates.
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-06-07
Jun 7, 2022
· release notes
ZPA adds pcappcap A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. command support on App Connectors for remote troubleshooting.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-06-06
Jun 6, 2022
· release notes
ZPA adds microtunnel rate limits, TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. keepalive move, expanded remote troubleshooting commands, and IP restrictions on App Connectors.
SessionStatus codes updated to include a new client-based remote assistance unavailable statusRate limits now apply to Microtunnels for client type management and Cloud Connector management TCP Keepalive option moved from Segment Groups to Application Segments in Client Connector Access ICMP, TCP, and PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. commands supported on Private Service Edges for remote troubleshooting data collection IP address or subnet restrictions available for App Connector Groups (Limited Availability)
5 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-06-03
Jun 3, 2022
· release notes
ZDX Call Quality apps now offer Monitoring Criteria filters to identify meeting hosts.
Adds Monitoring Criteria filters when adding a new tenant in ZDX Call Quality applications for Microsoft Teams and Zoom to limit monitoring to meetings hosted by specific users.
1 detail in Everything
Client Connector — ZDX Module Release Summary (2022) — 2022-06-03
Jun 3, 2022
· release notes
ZDX Module 3.3.1 adds CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. /Memory/Network I/O/Disk I/O process attribution and cloud path metrics for Windows.
Supports health metrics reporting the process contributing most to CPU, Memory, Network I/O, and Disk I/O usage. Updates page fetch metrics including TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connection time, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. handshake time, HTTP request/response processing, server response time for Web Probes, and Forward Method.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-06-03
Jun 3, 2022
· release notes
ZIA adds Spanish/Canadian DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. name dictionaries, ICAP client auth via MTLS MTLS Mutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. MIP label support for inline web DLP policies
Adds Names (Canada) and Names (Spain) predefined DLP dictionaries to detect personal names from those countries. Adds client authentication support for ICAP and Zscaler Incident Receivers via mutual Transport Layer Security (MTLS) CA Certificates. Enables quarantine malware action in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Control policies for Salesforce and ServiceNow. Adds a new Administration > Microsoft Information Protection (MIP) Labels page and a new MIP dictionary type for defining inline web DLP policies based on MIP labels.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! ZIA Sandbox integration with Carbon Black Endpoint Standard and Carbon Black Enterprise EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. is deprecated; Zscaler no longer supports this integration or can fetch telemetry from those platforms.
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-06-03
Jun 3, 2022
· release notes
Cloud Connector Admins can now select None for Location scope without pre-creating a location.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-06-02
Jun 2, 2022
· release notes
ZPA introduces a new Private Service Edge dashboard to help security teams monitor health and diagnose issues.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-05-27
May 27, 2022
· release notes
ZIA adds inline content printing and search to Cloud Browser Isolation, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary coverage for Spanish/Canadian names, ICAP/ZIR client auth, and Salesforce/ServiceNow qu
icaps-mtls-enabled parameter added to Zscaler Incident receiver configuration to enable MTLS MTLS Mutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. client authenticationTwo new predefined DLP dictionaries: Names (Canada) and Names (Spain) Quarantine malware action available for Salesforce and ServiceNow in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Control policies Print function enabled per ZIA or ZPA isolation profile to allow selecting inline content from isolated browsers Search function added to Cloud Browser Isolation for finding text on web pages in isolated sessions
5 details in Everything
└──▷ BREAKING ON UPGRADE
! ZIA Sandbox no longer supports integration with Carbon Black Endpoint Standard or Carbon Black Enterprise EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. due to deprecated upstream APIs
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-05-23
May 23, 2022
· release notes
ZDX adds Analyze Score button to identify reasons for poor user experience scores.
Adds the Analyze Score clickable action in the ZDX Score Over Time graph on the user details page to view factors and explanations for low scores.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-05-20
May 20, 2022
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for Canadian/Spanish names, ICAP/Incident Receiver client auth via MTLS MTLS Mutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with. , and quarantine actions for Salesforce and ServiceNow SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API controls
└──▷ HOW TO FIND IT
Download the MTLS CA Certificate for an ICAP Receiver.
📍 Administration › ICAP Receivers
Adds two new predefined DLP dictionaries: Names (Canada) and "Names (Spain) Enables client authentication for ICAP and Zscaler Incident Receivers by using provided Mutual Transport Layer Security (MTLS) Certificate Authority (CA) Certificates Allows configuring the quarantine malware action under Malware Detection Rules in SaaS Security API Control policies for Salesforce and ServiceNow
3 details in Everything
└──▷ BREAKING ON UPGRADE
! ZIA Sandbox no longer supports integration with Carbon Black Endpoint Standard or Carbon Black Enterprise EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. due to deprecated third-party APIs
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-05-17
May 17, 2022
· release notes
Adds ZPA Private Service Edge stats to Log Streaming Service for monitoring.
Enables Private Service Edge Metrics log type in the Log Streaming Service configuration
1 detail in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-05-17
May 17, 2022
· release notes
Zscaler Client Connector 1.3 for Linux adds Posture types, VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel modes, ICMP support, and Debian package customization.
Adds Client Certificate posture type support Adds Process Check posture type support for Linux Adds full-tunnel and split-tunnel VPN mode support Adds ICMP protocol support in Zscaler Private Access (ZPA) Adds Debian installer package creation support
+1 more
show less
Allows changing the custom configuration parameter for the Debian package
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-05-13
May 13, 2022
· release notes
Cloud & Branch Connector adds AWS/Azure ID import via Advanced Settings, 2-hour upgrade windows, and DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. /Unencrypted tunnel modes.
Adds the ability to import AWS Account IDs and Azure Subscription IDs into the Zscaler Cloud Connector Portal from the Advanced Settings page Adds the ability to select a 2-hour window of time to schedule upgrades for Cloud or Branch Connectors Adds the ability to select DTLS or Unencrypted for the tunnel encryption mode when forwarding traffic to ZIA
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-05-06
May 6, 2022
· release notes
ZDX adds Admin Access configuration for the Client Connector Portal via Role Management
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-04-29
Apr 29, 2022
· release notes
ZDX introduces programmatic API access to digital experience data for ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. integration.
Client Connector — Release Upgrade Summary (2022) — 2022-04-22
Apr 22, 2022
· release notes
Client Connector Portal 3.20.0.231 adds Linux Process Check posture support
Supports the Process Check posture type for Linux devices in device posture profiles.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-21
Apr 21, 2022
· release notes
Cloud Browser Isolation now allows enabling the Print function per ZIA or ZPA isolation profile.
Enables the ability to print web pages from an isolated browser in Cloud Browser Isolation
1 detail in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-04-20
Apr 20, 2022
· release notes
Zscaler Client Connector 1.9 for Android adds Android 12 support with new background permission requirements.
Requires ignore battery optimization permission on Android 12+ to allow background operation
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-04-15
Apr 15, 2022
· release notes
ZDX hop view now shows device location icon and reverse traceroute for GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels.
Adds a device location icon in the cloud path hop view to indicate latitude/longitude detection Adds reverse traceroute in cloud path to display underlay hops for GRE tunnel routing
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-15
Apr 15, 2022
· release notes
ZIA adds DNS Request/Response category filtering, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. URL exceptions, and API user exclusion for M365 tenant profiles
Adds Requested Categories and Resolved Categories as separate fields in the DNS Filtering Rule policy configuration Adds Response Categories filter to the DNS Insights Logs page Adds Top Response Categories and Top Blocked Response Categories widgets to the DNS Overview dashboard Adds Cloud Apps & URL Exceptions for DLP list to exempt custom URL categories from DLP evaluation Updates DLP endpoints in the cloud service API to allow excluding users, groups, or departments from policy rules via request
5 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-04-15
Apr 15, 2022
· release notes
Zscaler Client Connector 3.20.0.231 adds Linux Process Check posture type
Client Connector — Client Connector App Release Summary (2022) — 2022-04-15
Apr 15, 2022
· release notes
Adds customDNS managed config key for ChromeOS MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. deployments
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-04-13
Apr 13, 2022
· release notes
ZIA Private Service Edge visible in ZDX cloud path hop view for private networks
Client Connector — ZDX Module Release Summary (2022) — 2022-04-13
Apr 13, 2022
· release notes
ZDX Module 3.3 adds device inventory plugin, ZIA PSE cloud path support, and traceroute latency measurement.
Adds the device inventory plugin to collect user, vendor, OS, and hardware information Enables ZIA Private Service Edge as a supported destination in the cloud path for single-leg connectivity
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-04-13
Apr 13, 2022
· release notes
ZPA adds CORS CORS A browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. /SameSite browser access controls and a new Inspection API for managing inspection segments and policies.
Adds CORS Request and SameSite Cookie Attribute options in the Browser Access application Settings page Adds CORS/SameSite permission toggle on the Roles page for Administrator roles Adds ZPA Inspection API to manage inspection application segments, policies, controls, and profiles via customer-facing endpoints
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-12
Apr 12, 2022
· release notes
ZIA introduces default isolation profiles for Cloud Browser Isolation to speed up setup.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-08
Apr 8, 2022
· release notes
ZIA adds MS Login V2 tenant profiles, DNS Request/Response categorization splits, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. URL exceptions, and user exclude/include via API.
Adds Version 2 tenant profile type for Microsoft Login Services in Administration > Tenant Profiles Splits the Requested Domain/Resolved IP Categories field into separate Requested Categories and Resolved Categories fields in Policy > DNS Control > Add DNS Filtering Rule Adds Top Response Categories and Top Blocked Response Categories widgets to the DNS Overview page Adds Cloud Apps & URL Exceptions for DLP list to exempt custom URL categories and URL encoded data from DLP evaluation Enables excluding or including specific users, groups, or departments in DLP policy rules via API
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The Office 365 Tenants field is renamed to Microsoft 365 Tenants or Tenant IDs in the Tenant Profile window! The column and filter Domain Category is replaced by Request Categories in the DNS Insights Logs page! The widgets Top IP Domain Categories and Top Blocked IP Domain Categories are replaced by Top Request Categories and Top Blocked Request Categories in the DNS Overview page
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-06
Apr 6, 2022
· release notes
ZIA adds contextual right-click menus to Cloud Browser Isolation across all clouds
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-04-01
Apr 1, 2022
· release notes
ZIA extends SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API support to Google Cloud Platform and Microsoft Azure
Adds Google Cloud Platform and Microsoft Azure as authorized SaaS tenants for the SaaS Security API Adds control policy and scan schedule configuration options for GCP and Azure tenants Adds GCP and Azure data to the SaaS Assets Summary Report, SaaS Assets Report, SaaS Security Insights, and Insights Logs
3 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-03-30
Mar 30, 2022
· release notes
Client Connector 3.8 adds Z-Tunnel 2.0 bypass options, split-tunnel VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection, and notification framework support.
Adds two new options for the Z-Tunnel 2.0 protocol bypass feature: Redirect Web Traffic to ZCC Listening Proxy and Use Z-Tunnel 2.0 for Proxied Web Traffic . Supports overriding Z-Tunnel 2.0 protocol settings via a new option on the User Privacy page. Adds detection of split-tunnel VPN configurations alongside existing full tunnel Trusted Network detection. Evaluates trusted network criteria against all default route adapters instead of specific interfaces.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-03-25
Mar 25, 2022
· release notes
ZIA adds GCP and Azure tenant onboarding via SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API; renames domain lookup setting
Adds Google Cloud Platform and Microsoft Azure as authorizable SaaS application tenants for monitoring Adds Enable Suspicious New Domains Lookup option to replace the previous Newly Registered Domain Lookup setting Adds GCP and Azure support in SaaS Assets Summary Report, Insights, and Insights Logs
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-03-18
Mar 18, 2022
· release notes
ZDX adds UCaaS Monitoring permissions to control access to Call Quality applications.
Client Connector — Client Connector App Release Summary (2022) — 2022-03-16
Mar 16, 2022
· release notes
Adds customDNS managed config for ChromeOS MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. deployments to override DNS servers
Client Connector — Release Upgrade Summary (2022) — 2022-03-11
Mar 11, 2022
· release notes
Zscaler Client Connector Portal 3.20.1 adds device deletion API, notification framework, and platform auth support
Adds public API endpoint to delete devices from the Zscaler Client Connector Portal Increases device token limit from 8 to 16 Supports enabling the Zscaler Notification Framework as an alternative to the default Windows notification system Supports authentication using the default browser for Linux
4 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-03-11
Mar 11, 2022
· release notes
Cloud Connector roles now include Template Permissions for granular admin access control.
Adds Template permissions (Location & Provisioning) to the Add Cloud Connector Role window
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-03-04
Mar 4, 2022
· release notes
ZDX adds a Page Fetch Time baseline to user details and protocol grouping for Adaptive probes in Cloud Path Hop View.
Adds a ZDX score baseline to the Page Fetch Time graph on the user details page Adds protocol grouping with tunnel type for Adaptive probes in the Cloud Path Hop View
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-03-04
Mar 4, 2022
· release notes
ZIA adds dcName to getVpnEndpoints API response and introduces a Cloud Network Performance Test tool.
Updates the getVpnEndpoints Cloud Service API endpoint to include the dcName field in the response for more accurate VIP VIP A Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. location data Introduces the Zscaler Cloud Network Performance Test Tool for collecting performance troubleshooting information via HTTP
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-03-04
Mar 4, 2022
· release notes
ZPA Admin Portal updates for diagnostics filters, IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. cert expiry warnings, and Source IP Anchoring status.
Diagnostics pages now accept semicolon-separated values in text input filters (e.g., Application: Server Port) IdP Configuration page displays expiry icons warning when IdP certificates are expired or nearing expiration Application Segment table shows an information icon for segments with Source IP Anchoring enabled
3 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-03-04
Mar 4, 2022
· release notes
Zscaler Client Connector Portal 3.20.1 adds device deletion API, higher token limits, Linux/Android default browser auth, and Zscaler Notification Framework.
Adds the ability for administrators to delete devices using the public API for the Zscaler Client Connector Portal Increases the device token limit from 8 to 16 Enables use of the Zscaler Notification Framework as an alternative to the default Windows notification system Supports authentication using the default browser for Linux Supports skipping trusted network criteria evaluation for Split VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Trusted Network detection
+1 more
show less
Supports a customizable list of VPN Trusted Network names for accurate detection
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2022) — 2022-03-04
Mar 4, 2022
· release notes
Cloud Connector roles now support controlling admin access to Templates (Location & Provisioning).
Adds Template Permissions for Location & Provisioning to the Cloud Connector Role configuration.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-03-02
Mar 2, 2022
· release notes
ZPA updates SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API group handling performance and renames a diagnostics table entry.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-02-25
Feb 25, 2022
· release notes
ZIA adds subcloud filter to VIP VIP A Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. APIs and new Cloud Performance Test tool
Adds subcloud query parameter to GET /vips, GET /vips/groupByDatacenter, and GET /vips/recommendedList endpoints for filtering virtual IP addresses. Introduces Zscaler Cloud Performance Test Tool for collecting network performance troubleshooting data.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-02-25
Feb 25, 2022
· release notes
ZPA adds remote troubleshooting capabilities for App Connectors and PSEs via new diagnostic commands.
Enables executing TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and ICMP ping commands remotely against App Connectors for troubleshooting Enables executing DNS and restart commands remotely against ZPA Private Service Edges for troubleshooting
2 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-02-25
Feb 25, 2022
· release notes
Adds username parameter to CLI for per-machine identity in Client Connector 3.7.2
Adds the username command-line parameter to specify a unique username for each machine.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-02-18
Feb 18, 2022
· release notes
ZIA now allows IP address ranges in URL categories and adds subcloud filtering to VIP VIP A Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. API endpoints.
Adds support for Custom IP Ranges and IP Ranges Retaining Parent Category fields in the Add/Edit URL Category window, enabling IP-based categorization. Updates the Cloud Service API to support reading, creating, and updating IP address ranges for predefined and custom URL categories. Adds the subcloud query parameter to the GET /vips, GET /vips/groupByDatacenter, and GET /vips/recommendedList endpoints to filter virtual IP addresses.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-02-14
Feb 14, 2022
· release notes
Admin Portal now shows Zscaler Client Connector cloud name in Trusted Network and Posture Profile policy criteria.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-02-11
Feb 11, 2022
· release notes
ZPA adds Privileged Remote Access for clientless SSH/RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. via new Portal and Console pages
Adds Privileged Remote Access feature enabling clientless access to applications supporting fully isolated SSH and RDP protocols Adds Privileged Portals page in the ZPA Admin Portal for defining application segments for privileged remote access Adds Privileged Consoles page in the ZPA Admin Portal for managing access to privileged applications Requires App Connector release 22.31.1 or later for Privileged Remote Access support
4 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-02-11
Feb 11, 2022
· release notes
Zscaler Client Connector Portal 3.20 adds split-tunnel VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection, ZIA posture profiles, macOS browser auth, and role-based admin
Adds support for selecting specific devices and registration details to create a filtered list for enrolled devices in the portal. Enables filtering data on the Enrolled Devices page without first exporting it. Supports authentication using the default browser for macOS. Adds new status details when remotely fetching logs from the device: Waiting for KeepAlive , Extraction in progress , Completed , Error while fetching logs . Improves Z-Tunnel 2.0 protocol bypass support by enabling traffic forwarding and tunneling using two new options in the Forwarding Profile configuration setting: Redirect Web Traffic to Zscaler Client Connector Listening Proxy and 'Use Z-Tunnel 2.0 for proxied Web Traffic'.
+9 more
show less
Adds posture-based risk profiles for Zscaler Internet Access (ZIA). Supports configuring role-based administration within the Zscaler Client Connector Portal. Enables customers to configure fallback options on Z-Tunnel 2.0 establishment failure. Adds the ability to detect if a device is running a split-tunnel VPN in addition to full tunnel VPN Trusted Network detection. Allows evaluation of trusted network criteria against all default route adapters. Supports Certificate Trust and Client Certificate posture types for the pre-Windows login machine tunnel. Supports overriding the Z-Tunnel 2.0 protocol settings by adding a new option on the User Privacy page. Provides administrators control to configure an automatic update of 64-bit images of Zscaler Client Connector for specific groups. Supports read-only access to the Zscaler Client Connector Portal during an upgrade.
14 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2022) — 2022-02-08
Feb 8, 2022
· release notes
ZPA Private Service Edge 22.31.1 adds DNS resolve and restart commands for troubleshooting.
Private Access (ZPA) — App Connector Release Summary (2022) — 2022-02-08
Feb 8, 2022
· release notes
App Connector 22.31.1 adds Privileged Remote Access for SSH/RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. and enhances remote troubleshooting with TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. /ICMP pings
Adds Privileged Remote Access support for applications using Secure Shell Protocol (SSH) and Remote Desktop Protocol (RDP) Enhances App Connector remote troubleshooting to include execution of TCP and ICMP ping commands
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-02-04
Feb 4, 2022
· release notes
ZDX adds on-trendline messaging for partial data availability on the User Overview page.
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-02-04
Feb 4, 2022
· release notes
ZIA adds ${ACTION}, ${TOTAL_TRIGGERED_DICTIONARIES}, and ${TOTAL_TRIGGERED_ENGINES} macros to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. notification templates.
└──▷ HOW TO FIND IT
Dynamically include the action outcome in a DLP alert email to inform responders immediately.
📍 ${ACTION}
Adds ${ACTION} macro for DLP notification templates, showing whether the transaction was allowed or blocked Adds ${TOTAL_TRIGGERED_DICTIONARIES} macro for DLP notification templates, showing total dictionaries triggered across rules Adds ${TOTAL_TRIGGERED_ENGINES} macro for DLP notification templates, showing total engines triggered across rules
3 details in Everything
Client Connector — Release Upgrade Summary (2022) — 2022-02-04
Feb 4, 2022
· release notes
Zscaler Client Connector 3.20 adds role-based admin, split-tunnel VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection, ZIA posture profiles, and filtered enrolled device lists.
Adds Forwarding Profile options Redirect Web Traffic to Zscaler Client Connector Listening Proxy and 'Use Z-Tunnel 2.0 for proxied Web Traffic' to improve Z-Tunnel 2.0 bypass support Adds new split-tunnel VPN detection capability in addition to full tunnel VPN Trusted Network detection Adds ability to filter data on the Enrolled Devices page without exporting Adds posture-based risk profiles for Zscaler Internet Access (ZIA) Adds role-based administration configuration within the Zscaler Client Connector Portal
+5 more
show less
Adds support for Certificate Trust and Client Certificate posture types for the pre-Windows login machine tunnel Adds ability to configure automatic update of 64-bit images for specific groups Adds fallback options for Z-Tunnel 2.0 establishment failure Adds overriding of Z-Tunnel 2.0 protocol settings via a new option on the User Privacy page Adds authentication using the default browser for macOS
10 details in Everything
Client Connector — ZDX Module Release Summary (2022) — 2022-02-03
Feb 3, 2022
· release notes
ZDX Module 3.2 adds NDR NDR Network detection and response, analyzing network activity to find threats and support investigation. It focuses on communication patterns and suspicious traffic across systems. support in ZIA None mode and FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. enablement.
Supports the No Default Route (NDR) environment in the Zscaler Internet Access (ZIA) None mode. Includes support to enable or disable FIPS mode.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-02-01
Feb 1, 2022
· release notes
ZPA adds integrated application deception for lateral movement lateral movement Moving from an initially compromised system or identity to other resources in a network. Attackers often use stolen credentials or trusted connections to expand their access. detection and an API endpoint for authentication domains.
Adds integrated application deception to detect lateral threat movement using decoys without additional VMs or hardware Adds a new API endpoint to retrieve all authentication domains for a customer
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2022) — 2022-01-31
Jan 31, 2022
· release notes
ZDX adds ZPA Private Service Edge support and Zoom Call Quality monitoring capabilities
Adds support for Zscaler Private Access (ZPA) Private Service Edge in the cloud path Introduces web probe rate limiting for internal applications through ZPA Adds Zoom Call Quality monitoring to track calls between multiple participants in a configured Zoom tenant
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-01-31
Jan 31, 2022
· release notes
ZIA adds Native and Browser-in-Browser isolation experience modes selectable in user profiles
Adds Native Browser Experience and Browser-in-Browser Experience options to Cloud Browser Isolation user profiles Admins can change the isolation experience mode for a user profile at any time via ZIA/ZPA Isolation Profile settings
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-01-28
Jan 28, 2022
· release notes
ZIA adds ML-based OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Application Service Groups in firewall policies, and extensive new Cloud Service API endpoints.
Allow Personal Office 365 Domains field added to Administration > Tenant Profiles > Add Tenant Profile page for Microsoft Login Services.ML-based image recognition (passports, driver's licenses) and OCR now supported in DLP policy rules with content inspection. Device information obfuscation configurable for admins via Administration > Role Management and for Zscaler Support via Help > Remote Assistance. Proximity Length configuration added to Editing Predefined DLP Dictionaries for matching high-confidence phrases.Application Service Groups dropdown added to Add Firewall Filtering Rule under Application criteria.
+3 more
show less
New Cloud Service API endpoints for DLP rule creation and management: GET /dlpEngines, POST /dlpNotificationTemplates, PUT /webDlpRules/{ruleId}, etc. Updated /dlpDictionaries endpoints support Exact Data Match (EDM) and Indexed Document Match (IDM) dictionary creation. GET /vips/groupByDatacenter endpoint added to return virtual IP addresses grouped by data center name.
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-01-25
Jan 25, 2022
· release notes
ZPA adds Entity Name and Payload Search Entity Name filter options to SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Sync Logs page
Adds Entity Name as a new column in the SCIM Sync Logs table to display user and group names.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-01-21
Jan 21, 2022
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. API endpoints, remote user firewall rules, and device info obfuscation.
Adds GET /vips/groupByDatacenter to the Cloud Service API to return virtual IP addresses grouped by data center name Adds Administration > Advanced Settings option Enable Firewall for Z-Tunnel 1.0 and PAC Road Warriors for remote user traffic firewall rules Adds Road Warrior criterion under the Location filter in firewall and forwarding policy for remote users Adds new DLP-related Cloud Service API endpoints including GET /dlpEngines, POST /webDlpRules, and others
4 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-01-19
Jan 19, 2022
· release notes
Zscaler Client Connector 1.8.2 for Android adds Always On VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. auto-enrollment and improves network switching.
Improves network switching on Android and Chrome OS in cases such as between Wi-Fi and LTE
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-01-14
Jan 14, 2022
· release notes
ZIA adds SHA-256 SHA-256 A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. filter to Web Insights, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros, and SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. report columns
Adds the SHA-256 filter to Web Insights Logs for logging SHA-256 transactions. Adds ${FILETYPE}, ${DICTIONARIES_IN_RULE}, ${DICTIONARIES_NOT_IN_RULE}, ${ENGINES_IN_RULE}, and ${ENGINES_NOT_IN_RULE} macros to DLP Notification Templates. Changes the default DLP notification Subject line macro from ${ENGINE} to ${RULENAME}. Adds Upload Bytes , Download Bytes , and Users columns to the Cloud Applications table in the Shadow IT Report.
4 details in Everything
└──▷ BREAKING ON UPGRADE
! DLP notification Subject lines now default to ${RULENAME} instead of ${ENGINE}.
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2022) — 2022-01-14
Jan 14, 2022
· release notes
Version 21.352.1 introduces Zscaler Digital Experience integration for performance monitoring and extends session status code support.
Private Access (ZPA) — App Connector Release Summary (2022) — 2022-01-14
Jan 14, 2022
· release notes
App Connector 21.352.1 enables remote execution of DNS resolve and restart commands for troubleshooting.
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-01-13
Jan 13, 2022
· release notes
ZPA LSS adds Private Service Edge status logs; Web Probe filter for User Activity Diagnostics
Adds Private Service Edge as a selectable log type when configuring a log receiver for Log Streaming Service (LSS) Replaces the deprecated 'get all LSS log formats' endpoint with a new API for retrieving log formats Adds Web Probe as a Connection Type filter in the User Activity Diagnostics page Displays the Manager version on the Private Service Edge page in the ZPA Admin Portal
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2022) — 2022-01-11
Jan 11, 2022
· release notes
ZPA adds remote troubleshooting commands for App Connectors and configurable default Admin role disabling.
Adds remote DNS resolve and restart execution capabilities to App Connectors via the Admin Portal for troubleshooting purposes Enables disabling the default ZPA Administrator role when another admin role with equivalent privileges is present
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2022) — 2022-01-07
Jan 7, 2022
· release notes
ZIA adds SHA-256 SHA-256 A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. Web Insights filter, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros, and Tenant Profile support for Webex.
Adds the SHA-256 filter to Web Insights Logs to support logging SHA-256 transactions Adds five new inline web DLP macros: ${FILETYPE}, ${DICTIONARIES_IN_RULE}, ${DICTIONARIES_NOT_IN_RULE}, ${ENGINES_IN_RULE}, and ${ENGINES_NOT_IN_RULE} for DLP Notification Templates Changes the default DLP notification Subject line to use ${RULENAME} instead of ${ENGINE} Adds Tenant Profile support for Webex Login Services
4 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-01-07
Jan 7, 2022
· release notes
Client Connector 3.6 for macOS adds CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. checks, antivirus posture, browser auth, and ZPA ICMP support.
Includes Certificate Revocation List (CRL) check in client certificate posture profile to detect revoked certificatesIncludes support for the ICMP protocol over Zscaler Private Access (ZPA) Provides support for antivirus posture checks as configured in the portalProvides option to use a new PAC parser Sets password protecting the disabling of the ZPA and Zscaler Digital Experience (ZDX) services with the ability to set separate passwords for disabling Zscaler Internet Access (ZIA) versus exiting the application
5 details in Everything
Client Connector — Client Connector App Release Summary (2022) — 2022-01-06
Jan 6, 2022
· release notes
Zscaler Client Connector 1.8.7 adds multiple trusted networks, packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. , remote log fetch, and larger SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. support on iOS
multiple trusted networks support added for Zscaler Private Access (ZPA) profilesPacket capture capability added to the Client Connector app UI Remote log fetching enabled for enrolled devices without user intervention Automatic ZIA reactivation notification added based on portal profile settings
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-12-16
Dec 16, 2021
· release notes
ZDX adds support for monitoring Microsoft Teams Call Quality
Maps user and device information from Microsoft directly to ZDX users and devices for call participants. Enables parallel analysis of Call Quality with Cloud Path probes and device metrics/events.
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-12-15
Dec 15, 2021
· release notes
Client Connector 3.7.1 for Windows adds split VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. interface binding and trusted network DNS detection.
Adds configuration options in tunnel mode to bind Zscaler Client Connector to a specific network interface, enabling Split VPN with exclude routes on Windows 3.7.1 Adds configuration option to detect trusted networks by routing DNS requests through the default adapter on Windows 3.7.1
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-12-10
Dec 10, 2021
· release notes
ZIA adds remote user firewall rules, Cloud Application Risk Profiles, Webex Teams and MS365 SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. coverage, and TLS 1.3 cipher support.
Adds Enable Firewall for Z-Tunnel 1.0 and PAC Road Warriors option in Administration > Advanced Settings to enable Source IP Anchoring for remote user firewall rules Adds Road Warrior under the Location criterion in firewall and forwarding policies for remote user traffic Introduces Cloud Application Risk Profile in Administration > Risk Profiles to associate granular cloud app attributes with cloud app control rules Adds Webex Teams as a SaaS Application Tenant and enables SaaS Security API Control policies, scan configuration, assets reports, and insights logs for it Adds Microsoft 365 as a SaaS Application Tenant and enables SaaS Security Posture Control policy and report coverage for it
+3 more
show less
Enables viewing and editing the sanctioned state (Sanctioned/Unsanctioned) of applications from the Cloud Application Status page and SaaS Security Report Adds hardware-accelerated support for TLS 1.3 with cipher suites TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, and TLS_AES_128_GCM_SHA256 Adds Webex Login Services support in Tenant Profiles to restrict access to organization-specific Webex Teams and Meetings
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-12-08
Dec 8, 2021
· release notes
ZPA adds support for Cloud Connector client type and grouping in Admin Portal
Enables configuration of policy rules using Cloud Connector groups
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-12-03
Dec 3, 2021
· release notes
Partners can now manage provisioned customers and tenants, view policies, white-label the admin portal, and access via SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. through the new Management Portal.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-12-01
Dec 1, 2021
· release notes
ZPA introduces client-based remote assistance for Windows devices via the Application Segment page.
Adds client-based remote assistance functionality for domain-joined Windows devices in Zscaler Private Access.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-11-26
Nov 26, 2021
· release notes
Zscaler Client Connector 3.7 for Windows adds ZPA-to-ZPA connection, 64-bit support, Windows 11 support, PKCE PKCE Proof Key for Code Exchange, an OAuth safeguard that binds an authorization code to the client that requested it. An intercepted code cannot be redeemed without the client's matching verifier. enrollment, and internal tunnel mode.
Adds the ability to connect from one Zscaler Private Access (ZPA) enabled Zscaler Client Connector to another for application-like remote assistance Supports running Zscaler Client Connector as a 64-bit application Includes support of internal tunnel traffic in tunnel mode, in addition to the Tunnel with Local Proxy (TWLP) mode Adds verification using proof key for code exchange (PKCE) with Zscaler Internet Access (ZIA) for user enrollment Provides a text field in the Zscaler Client Connector app to explain the reason for disabling a service
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Zscaler Client Connector no longer supports Windows 7 and Windows 8
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-11-19
Nov 19, 2021
· release notes
ZDX Setup Wizard available in Standard plan for ZIA admins to enable service and manage roles.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-11-19
Nov 19, 2021
· release notes
ZIA adds Cloud App Control Isolate action, device criteria, Spanish/Japanese DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dicts, and native browser isolation mode
Adds the Isolate action to Cloud App Control policy rules, allowing traffic matching a rule to be routed to a selected Cloud Browser Isolation profile. Adds Allow Consumer Access field in the Add Tenant Profile page for Google App to control consumer domain access. Adds Microsoft Office 365 super-category (MS O365 Allow , MS O365 Default , MS O365 Optimize ) under the URL Categories field on SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection Policy rule page. Adds predefined Office 365 One Click rules for Collaboration, Productivity, File Sharing, Hosting, IT Services, and Webmail categories when Microsoft-Recommended config is enabled. Adds predefined UCaaS One Click rules for Zoom, RingCentral, or LogMeIn when selected on the Advanced Policy Settings tab.
+7 more
show less
Adds Zscaler Client Connector Portal option in Role Management to restrict admin access to the client portal. Renames Block on URL FQDN & Host Header Mismatch to Block Domain Fronting and its associated Insights/NSS report reason to Access denied due to Domain Fronting . Adds Cloud Apps & URL Exceptions list for DLP to exempt specific apps/URLs from evaluation. Adds Spanish Social Security Number predefined DLP dictionary and Data Type for EDM templates. Adds Japanese Corporate Number and My Number predefined DLP dictionaries and Unicode phrase support. Adds Devices and Device Groups pages in Admin Portal and new criteria to URL Filtering, Cloud App Control, SSL Inspection, Firewall Control, and File Type Control policies. Adds Native Browser Experience and Browser-in-Browser Experience modes for Cloud Browser Isolation user profiles.
12 details in Everything
└──▷ BREAKING ON UPGRADE
! The policy reason Access denied due to URL FQDN and Host Header Mismatch in Insights and NSS reports is renamed to Access denied due to Domain Fronting .
Cloud & Branch Connector — Release Upgrade Summary (2021) — 2021-11-19
Nov 19, 2021
· release notes
Zscaler Cloud Connector now allows admins to use SAML SSO SAML SSO An authentication protocol that lets a user log in once with an identity provider and access multiple services without re-entering credentials, by passing signed XML assertions between parties. for authentication across multiple cloud platforms.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-11-12
Nov 12, 2021
· release notes
Adds CSV download capability from the User Overview page for ZDX Score categories.
Enables CSV file export directly from the User Overview page, reflecting the current table view for each ZDX Score category (Poor, Okay, or Good)
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-11-12
Nov 12, 2021
· release notes
ZIA adds Isolate action to Cloud App Control, device group policy criteria, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. exceptions, and domain fronting blocking.
Adds Device and Device Group as new criteria in URL Filtering, Cloud App Control, SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection, Firewall Control, and File Type Control policies Adds Isolate Action option to Cloud App Control policy rules Adds Cloud Apps & URL Exceptions for DLP list to exempt apps and URLs from DLP evaluation Adds new predefined DLP dictionary: Social Security Number (Spain) Adds new predefined DLP dictionaries: Corporate Number (Japan) and My Number (Japan)
+1 more
show less
Renames Block on URL FQDN & Host Header Mismatch to Block Domain Fronting in Advanced Settings
6 details in Everything
Cloud & Branch Connector — Release Upgrade Summary (2021) — 2021-11-12
Nov 12, 2021
· release notes
Cloud & Branch Connector adds SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support for admin configurations
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-11-08
Nov 8, 2021
· release notes
ZPA Admin Portal gains end time on dashboards and fixes SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. segment configuration bugs
Enables the end time display in the Applications and Users dashboards within the ZPA Admin Portal. Updates ZPA Public Service Edges to correctly process SCIM attribute updates for connectivity stability.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-11-05
Nov 5, 2021
· release notes
ZIA adds partner portal, browser isolation for unmanaged devices, IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. /Insights log filter updates
Adds Zscaler Management Portal for Partners to manage provisioned customer tenants and white-label the admin portal via SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. Adds Device Trust Attribute and Device Trust Attribute Value fields in Administration > Authentication Settings > Identity Provider > Add/Edit IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. to identify managed devices Adds Notification Text field in Administration > End User Notifications page for block violation messages Renames Threat Category filter to Advanced Threat Category in Firewall Insights Logs Renames Advanced Threat Super Category filter to Advanced Threat Category in Mobile and Web Insights Logs
+2 more
show less
Removes Suspicious Content, Suspicious Destinations, and Advanced Security options from the Advanced Threat Category field in IPS Control rules Enables browser isolation or blocking for sessions from unmanaged devices in Administration > Identity Proxy Settings > Add/Edit Cloud Application
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-11-01
Nov 1, 2021
· release notes
Adds a new Comprehensive App Connector Stats log type to the Log Streaming Service for detailed App Connector metrics.
Enables selection of the new Comprehensive App Connector Stats log type when configuring a log receiver
1 detail in Everything
Private Access (ZPA) — App Connector Release Summary (2021) — 2021-10-27
Oct 27, 2021
· release notes
App Connector 21.255.2 adds Hypervisor CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. steal reporting and comprehensive stats via new Log Streaming Service log type.
Adds support for a new log type in the Log Streaming Service (LSS) to provide comprehensive App Connector statistics. Enables App Connectors to report CPU time stolen from the VM by a Hypervisor.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-10-26
Oct 26, 2021
· release notes
ZPA adds VM CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. steal time reporting to Connectors/PSEs and improves LSS GID-to-name translation for ClientZEN/ConnectorZEN names.
App Connectors and ZPA Private Service Edges now report VM CPU steal time collected from the Hypervisor Log Streaming Service lookup adds GID-to-name translations to correctly resolve ClientZEN and ConnectorZEN names when traffic is processed by a ZPA Private Service Edge
2 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-10-22
Oct 22, 2021
· release notes
Zscaler Client Connector Portal 3.19 adds macOS posture checks, ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. 32-bit support, and DNS/interface binding options.
Supports OS-based posture checks for macOS Supports antivirus-based posture checks for macOS Supports 32-bit architecture for ARM processor devices Supports Windows 64-bit for Zscaler Client Connector Includes option to view and enable available releases (General Availability and Limited Availability) from the Client Connector App Store
+5 more
show less
Includes the option to bind the DNS request to the default adapter Supports configuring the Zscaler Client Connector to follow the routing table for connections or bind to the default interface Supports sending the reason a Zscaler service was disabled on a device to the Zscaler Client Connector Portal, which is viewable in the registered device details Includes showing the date and time when devices were unregistered or removed as part of the exported information for devices Increased the minimum Zscaler Client Connector logging size configuration from 10 MB to 50 MB
10 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the License chart in the Zscaler Client Connector Portal Dashboard for customers with only ZPA
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-10-21
Oct 21, 2021
· release notes
Adds support for Zscaler Private Access (ZPA) in ZDX to measure internal application performance and display Cloud Path on Windows.
Requires Zscaler Client Connector version 3.6.1 for Windows and App Connector 21.224.1.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-10-21
Oct 21, 2021
· release notes
ZIA adds Self-Harm & Cyberbullying DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary and engine for student safety in limited availability
Adds Self-Harm & Cyberbullying predefined DLP dictionary to detect content related to self-harm and cyberbullying. Adds Self-Harm and Cyberbullying predefined DLP engine to detect violations of student safety using the new dictionary.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-10-21
Oct 21, 2021
· release notes
ZPA now supports Digital Experience (ZDX) for monitoring internal application performance via encrypted data shipment to ZDX infrastructure.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-10-20
Oct 20, 2021
· release notes
ZPA adds management APIs for connectors/service edges and a generic policy API with pagination.
New POST/PUT/DELETE endpoints for App Connectors, App Connector Groups, Service Edges, Service Edge Groups, and Log Streaming Service (LSS) configurations Prerequisite APIs to retrieve version profiles, client types, status codes, LSS formats, and enrollment certificates/provisioning keys New API endpoint to reorder policy rules Generic policy API accepting policyType parameter replacing specific global/reauth/bypass endpoints Paginated APIs for browser access (BA) certificates, IdPs, posture profiles, trusted networks, and SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attributes
+1 more
show less
Enhanced port range configuration using single-value fields replacing deprecated tcpPortRanges/udpPortRanges
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The tcpPortRanges and udpPortRanges fields in application segment configuration are deprecated in favor of tcpPortRange and udpPortRange.! API endpoints specific to policy types (global/reauth/bypass) are deprecated; use the generic API with policyType parameter instead.! Endpoints for BA certificates, IdPs, posture profiles, trusted networks, and SAML attributes are deprecated in favor of new paginated versions.
Client Connector — Release Upgrade Summary (2021) — 2021-10-15
Oct 15, 2021
· release notes
Zscaler Client Connector Portal 3.19 adds macOS posture checks, ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. 32-bit support, and UI enhancements.
Adds OS-based posture checks for macOS. Adds antivirus-based posture checks for macOS. Supports 32-bit architecture for ARM processor devices. Supports configuring the Zscaler Client Connector to follow the routing table for connections or bind to the default interface. Includes option to view and enable available releases (General Availability and Limited Availability) from the Client Connector App Store.
+3 more
show less
Adds ability to send the reason a Zscaler service was disabled on a device to the Zscaler Client Connector Portal, viewable in registered device details. Adds binding DNS request to default adapter option. Increases minimum logging size configuration from 10 MB to 50 MB.
8 details in Everything
└──▷ BREAKING ON UPGRADE
! Removes the License chart in the Zscaler Client Connector Portal Dashboard for customers with only ZPA.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-10-15
Oct 15, 2021
· release notes
ZIA Sandbox Reports add HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. JA3 JA3 A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. /JA3 Digest fields and MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. technique mapping tile.
Sandbox BAUI Report now includes an HTTPS section under Network Packets with JA3 and JA3 Digest information Sandbox BAUI Report adds a new MITRE MITRE A US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CK ATT&CK A publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tile to view techniques and associated color-coded hit counts
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-10-12
Oct 12, 2021
· release notes
Zscaler Client Connector 1.2 for Linux adds cloud selection, FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. support, and Cisco/Pulse VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. interoperability.
Adds the ability to select a specific Zscaler cloud for connection. Enables FIPS mode when the ad hoc cloud name option is provided by default. Allows co-existence with Cisco AnyConnect and Pulse Secure VPN clients in split tunneling mode.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-10-11
Oct 11, 2021
· release notes
ZPA now supports Cloud Browser Isolation integration.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-10-08
Oct 8, 2021
· release notes
ZIA Sandbox BAUI Report gains JA3 JA3 A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. /JA3 Digest fields and MITRE ATT&CK MITRE ATT&CK A publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. technique tile.
Adds JA3 and JA3 Digest fields to the HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. section of the Sandbox BAUI Network Packets view Adds a new MITRE MITRE A US federally funded research and development center that maintains public frameworks—ATT&CK, CVE, D3FEND—that cyber tools use to classify threats, vulnerabilities, and defensive techniques in a common language. ATT&CK ATT&CK A publicly maintained knowledge base by MITRE cataloguing adversary tactics, techniques, and procedures observed in real attacks, giving cyber tools a common taxonomy for classifying and correlating threat behavior. tile to the Sandbox BAUI Report showing hit techniques by color-coded number
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-10-04
Oct 4, 2021
· release notes
Adds filters for application domain, port, connection status code, and other fields to User Activity Trends
Client Connector — ZDX Module Release Summary (2021) — 2021-10-01
Oct 1, 2021
· release notes
ZDX Module 3.0 for Windows increases traceroute probe limit beyond 30 and fixes several network diagnostics issues.
Supports increasing the limit of traceroute probes to more than 30.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-10-01
Oct 1, 2021
· release notes
ZDX Admin Portal resets filters on logout/timeout and improves Deep Tracing PDF layout.
Logs out or timeouts now reset the Time Range Filter to 2 hours and clear all other filters in the ZDX Admin Portal. After a session timeout, users land on the page they were navigating when the timeout occurred. Deep Tracing PDF files now use logical page and line breaks in their page layout.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-10-01
Oct 1, 2021
· release notes
ZIA adds custom high-confidence phrases to DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries and supports Box classification labels in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API DLP policies.
Adds Custom High Confidence Phrases capability for applicable predefined DLP dictionaries Adds Box Classification Labels support in SaaS Security API DLP policy rules
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-10-01
Oct 1, 2021
· release notes
Zscaler Client Connector 3.6.1 for Windows adds ZDX Cloud Path support and granular geolocation permission logic.
Supports Zscaler Private Access (ZPA) applications in the Zscaler Digital Experience (ZDX) Cloud Path Adds a permission check in the ZSATray to read geolocation information only if enabled at both the user and machine level Changes allowlist file name from Certutil.exe to ZSFFutil.exe
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-09-28
Sep 28, 2021
· release notes
ZPA Admin Portal adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. Sync Logs to monitor user and group state changes
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-09-24
Sep 24, 2021
· release notes
ZIA adds custom high confidence phrases for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. , Box labels to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. API, and limited OCR OCR Optical character recognition, converting text in an image or scanned document into machine-readable characters. It lets software search or process text that was stored as pixels. for DLP content inspection
Adds custom_high_confidence_phrases support for applicable predefined DLP dictionaries and displays their default phrases Adds Zscaler Incident Receiver and Email Notification options to the SaaS Security API DLP policy for all application types Adds Box classification label matching for SaaS Security API DLP policy rules targeting Box tenants Introduces limited availability OCR support for DLP content inspection to scan images in files
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-09-17
Sep 17, 2021
· release notes
ZDX adds multi-cloud SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. login via Relay State, Current Score view, and time range retention for User Overview
Adds support for Multi Cloud Support for SAML Login from IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. by accepting a ZIA cloud domain name in the Relay State field to target specific clouds during authentication Enables viewing the most-current ZDX Score via the Current Score button on the ZDX dashboard, User Overview dashboard, and User details page Retains the selected time range when navigating from the ZDX Score Over Time graph to the User Overview and User details pages
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-09-13
Sep 13, 2021
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Activity Alerts, new NSS log type, and expanded web log fields for SaaS activities
Adds SaaS Security Activity Alerts to configure alerts for specific SaaS application activities and view performing users. Adds SaaS Security Activities & Alerts Report for overview of user SaaS activities and triggered alerts with further details. Adds 20 new web log fields to NSS Feed outputs: %d{intlogtime}, %d{inteventtime}, %d{userid}, %d{cid}, %d{tid}, %d{src_id}, %d{appid}, %d{abstime}, %d{objtype1}, %d{objcnt1}, %d{objtype2}, %d{objcnt2}, %s{logtime}, %s{eventtime}, %s{loc_name}, %s{username}, %s{tenant}, %s{appname}, %s{objnames1}, and %s{objnames2}.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-09-13
Sep 13, 2021
· release notes
ZPA adds version profiles for App Connectors and Private Service Edge groups; improves deletion validation.
Adds version profile configuration to App Connector group and ZPA Private Service Edge group in the ZPA Admin Portal Enforces policy linkage check during application segment deletion via the Admin Portal
2 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-09-10
Sep 10, 2021
· release notes
Zscaler Client Connector Portal 3.18.0.112 adds options to disable parallel IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. and IPv4 DNS requests
Adds new profile options to control parallel IPv6 and IPv4 DNS request behavior Extends Zscaler Client Connector Profile configuration with parallel DNS toggles
2 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-09-03
Sep 3, 2021
· release notes
Adds options to disable parallel IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. and IPv4 DNS requests in Zscaler Client Connector Portal 3.18.0.112
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-09-03
Sep 3, 2021
· release notes
ZIA adds support for External Syslog Server Forwarding via Zirsvr.
└──▷ TRY IT
Configure the Zscaler Incident Receiver to forward logs to an external syslog server for centralized monitoring.
copy
$ sudo zirsvr configure-syslog-server
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-08-31
Aug 31, 2021
· release notes
App Connector dashboard gains new health metrics and widgets for expanded monitoring.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-08-27
Aug 27, 2021
· release notes
ZIA adds rule labels for URL Filtering via API/portal, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. scanning exceptions, restricted admin IP access, and EUN language support.
POST and PUT /urlFilteringRules endpoints now accept ruleLabels to create and manage policy rule groups via the ZIA Admin Portal API.Scanning Exceptions tab under Policy > SaaS Security API Control allows exempting specific folders from DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and Malware Detection policies for file-sharing apps.Status toggle for the Default Admin account via the Status option in the Admin Portal or Admin & Role Management endpoints in the cloud service API. Restricted admin access to the ZIA Admin Portal can be enforced by configuring source IP address restrictions for admins.
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-08-26
Aug 26, 2021
· release notes
ZPA adds TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Keepalive for App Connectors in Segment Groups and fixes SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API schema issues
Improves SCIM service schema by correcting user attribute types, removing duplicate group attributes, and including the name sub-attribute in GET requests.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-08-20
Aug 20, 2021
· release notes
ZDX adds device event category filtering, time zone labels on dashboard graphs, and context-aware new tab links.
Adds ability to filter User Device Events by category in the UI Adds time zone labels to start/end of timelines on ZDX, Users, and Applications dashboards Preserves applied filters when opening username or application links in a new browser tab
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-08-20
Aug 20, 2021
· release notes
ZIA adds EUN i18n, admin status API control, rule labels, SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. activity alerts/reports/logs, scanning exceptions, restricted admin access, new NSS ESXi image
Adds Italian, Indonesian, Korean, Spanish (Latin America), Turkish, Thai, Vietnamese language support for Enterprise User Numbers (EUNs). Enables enabling or disabling the Default Admin account via a Status option and Admin & Role Management API endpoints. Introduces Rule Labels to logically group URL Filtering policy rules in the ZIA Admin Portal and via POST/PUT /urlFilteringRules API calls. Provides SaaS Security Activity Alerts to track specific user activities and log them to the SaaS Security Activities & Alerts Report. Introduces a new SaaS Security Activities & Alerts Report for overview and details of users’ SaaS application activities and triggered alerts.
+8 more
show less
Adds a new NSS Log Type for SaaS Security Activity in NSS Feeds. Expands NSS Feed outputs with new fields: %d{intlogtime}, %d{inteventtime}, %d{userid}, %d{cid}, %d{tid}, %d{src_id}, %d{appid}, %d{abstime}, %d{objtype1}, %d{objcnt1}, %d{objtype2}, %d{objcnt2}, %s{logtime}, %s{eventtime}, %s{loc_name}, %s{username}, %s{tenant}, %s{appname}, %s{objnames1}, %s{objnames2}. Requires entering a Dropbox Enterprise ID to add a Dropbox tenant via the SaaS Security API. Allows choosing between Salesforce Sandbox or Production environments when adding a Salesforce tenant via the SaaS Security API. Adds a Scanning Exceptions tab (Policy > SaaS Security API Control) to exempt specific folders from SaaS Security API DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and Malware Detection policies for file sharing applications. Adds a Remediation Action column to the SaaS Assets Report: Assets with Incidents page under File Sharing Applications. Enforces access restrictions to the ZIA Admin Portal based on the admin’s source IP address. Releases a new NSS image (.ova) for ESXi environments based on the latest Zscaler Operating System.
13 details in Everything
└──▷ BREAKING ON UPGRADE
! Existing Microsoft OneDrive or SharePoint tenants created prior to this release must be reauthorized to use SaaS Security Activity Alerts and the SaaS Security Activities & Alerts Report.
Client Connector — Client Connector App Release Summary (2021) — 2021-08-20
Aug 20, 2021
· release notes
Zscaler Client Connector 3.4 for macOS adds ARM ARM A family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. /M1 support, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. TWLP, and Z-Tunnel fallback config.
Adds native ARM support for M1 Macs Adds native IPv6 support for Tunnel with Local Proxy (TWLP), Enforce Proxy, and None modes Adds the ability to drop IPv6 traffic via a new Client Connector Portal setting Changes the packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file location to /Library/Application Support/com.zscaler.Zscaler Adds user-driven fallback from Z-Tunnel 2.0 to Z-Tunnel 1.0 for UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. connectivity issues
+5 more
show less
Adds full tunnel VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection for verifying trusted network detection Adds support for restoring previous system proxy settings upon exiting via app profile settings in the Portal Improves performance for ZPA applications opening a high number of sockets Adds an option to configure Zscaler Private Access (ZPA) reauthentication notifications under System Tray Notification Settings Adds configuration for Z-Tunnel 2.0 fallback forwarding behavior for web and non-web traffic
10 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-08-19
Aug 19, 2021
· release notes
ZPA Admin Portal adds real-time user tunnel visibility and M-Tunnel session termination on re-authentication.
Adds Real-time and historical views of machine tunnel connections in the Recent Users and Current Connected Users widgets within the Users Dashboard Enables termination of users' running application sessions upon re-authentication via timeout policy, including existing ZPA Microtunnels (M-Tunnels) upon authentication expiry or policy change
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-08-19
Aug 19, 2021
· release notes
Client Connector 1.8.1 for Android adds Chrome OS auto-enrollment and CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architecture tracking.
Adds automatic enrollment for Zscaler Client Connector users on Chrome OS
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-08-18
Aug 18, 2021
· release notes
ZPA adds sub-cloud geofencing for Service Edges, M-Tunnel termination, and TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. Keepalive for App Connectors
Adds support for geofencing at the sub-cloud level for ZPA Public Service Edges (PSE) and Private Service Edges (PSE) Enables termination of existing ZPA Microtunnels (M-Tunnels) in preparation for functionality changes Configures App Connectors to maintain TCP communication sockets using the TCP Keepalive socket option
3 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-08-13
Aug 13, 2021
· release notes
Zscaler Client Connector Portal 3.18 adds SCCM profile configuration, antivirus/OS posture checks, device quarantine, and enrolled device export.
Adds option to configure Windows Zscaler Client Connector profiles for SCCM Adds support for antivirus-based posture checks for Windows Adds support for OS-based posture checks for Windows Adds ability to password protect the disabling of the Zscaler Private Access (ZPA) service Adds support for quarantining enrolled devices
+1 more
show less
Adds option to export service information for enrolled devices
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-08-13
Aug 13, 2021
· release notes
ZIA APIs now support full CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Dictionaries and AI/ML categorization covers Webmail
Adds GET /dlpDictionaries, POST /dlpDictionaries, GET /dlpDictionaries/lite, GET /dlpDictionaries/{dlpDictId}, PUT /dlpDictionaries/{dlpDictId}, DELETE /dlpDictionaries/{dlpDictId}, and POST /dlpDictionaries/validateDlpPattern endpoints for full DLP Dictionary lifecycle management Extends AI/ML-Based Content Categorization support to the Webmail URL category
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-08-11
Aug 11, 2021
· release notes
Zscaler Client Connector for Linux reaches version 1.1 with support for multiple distributions and CentOS 8 validation.
Adds support for multiple Linux distributions within a single installation package for the Linux client.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-08-10
Aug 10, 2021
· release notes
Client Connector 3.6 adds antivirus posture checks, ZDX status, browser auth, and registry folder safeguards.
Adds support for antivirus signature status posture checks, configurable in the Zscaler Client Connector Portal Adds support for displaying current status of ZDX, ZIA, and ZPA in the portal Adds password protection for disabling the Zscaler Private Access (ZPA) service via Portal settings Adds support for browser-based authentication via Portal configuration Safeguards the Zscaler root folder in the Windows registry to enhance security
+1 more
show less
Improves App Policy name display in the UI by dynamically adjusting window size
6 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-08-06
Aug 6, 2021
· release notes
New Zscaler Management Portal for Partners allows partners to manage provisioned customers and tenants via SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. , white labeling, and policy visibility
Adds the Zscaler Management Portal for Partners as a new interface for partners to oversee customer and tenant accounts across different Zscaler clouds Enables viewing of customer and tenant account configurations, policies, and applied policy templates within the partner portal Allows white labeling of the ZDX Admin Portal that tenants access Provides SSO access to tenants' ZDX Admin Portals from the partner portal
4 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-08-06
Aug 6, 2021
· release notes
Zscaler Client Connector Portal 3.18 adds Windows posture checks, SCCM profile config, and device filtering/search capabilities.
Adds option to enable Browser Based Authentication in Administration settings for Windows. Adds option to configure Windows Zscaler Client Connector profiles for SCCM. Adds support for antivirus-based posture checks for Windows. Adds support for OS-based posture checks for Windows. Adds ability to password protect the disabling of the Zscaler Private Access (ZPA) service.
+4 more
show less
Adds quarantining capability for enrolled devices. Adds option to export service information for enrolled devices. Adds options to filter active devices by periods of time and search by Device ID, UDID, Machine Name, or Hardware Fingerprint in the portal. Enables tooltips for app profile fields to display entire text strings when truncated.
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-08-06
Aug 6, 2021
· release notes
ZIA adds full CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries and a Partner Management Portal for tenant oversight.
└──▷ TRY IT
Retrieve a list of all configured DLP dictionaries using the new API endpoint.
copy
$ GET /dlpDictionaries
Validate a custom DLP pattern before deploying it to ensure syntax correctness.
copy
$ POST /dlpDictionaries/validateDlpPattern
Adds GET, POST, PUT, DELETE endpoints on /dlpDictionaries to create, read, update, and delete DLP Dictionaries via the Cloud Service API. Adds GET /dlpDictionaries/lite endpoint for retrieving lightweight DLP Dictionary data. Adds POST /dlpDictionaries/validateDlpPattern endpoint for validating DLP patterns programmatically. Adds Zscaler Management Portal for Partners to manage provisioned customers and tenants, including white-labeling the Admin Portal and accessing via SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. .
4 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-08-03
Aug 3, 2021
· release notes
Zscaler Client Connector 1.7.2.27 for Android adds MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. Google account username fetch and 32-bit support
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-07-30
Jul 30, 2021
· release notes
ZIA adds FQDN/host header mismatch blocking, new NSS log field, M365/IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. dashboard drill-downs, and expanded Cloud App Control categories.
Adds Block on URL FQDN & Host Header Mismatch option in Administration > Advanced Settings to block HTTP/S traffic when the request URL FQDN does not match the host header Adds new Web Insights log field and NSS streaming syntax %s{df_hosthead} (new field: Domain Fronted Host Header) to capture mismatched host headers Renames existing Web Insights field Domain Fronted Hostname to Domain Fronted SNI Enables drill-down from Microsoft 365 dashboard widgets via View Logs and Analyze Chart actions Adds new cloud app categories (Hosting Providers, Human Resources, Instant Messaging, IT Services, Productivity & CRM Tools, Sales & Marketing, Social Networking, Streaming Media, System & Development, Webmail) to Cloud App Control policy
+1 more
show less
Enables direct log viewing from IPS Overview dashboard widgets via View Logs option
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The Domain Fronted Hostname field in Web Insights is renamed to Domain Fronted SNI , which will break filters, columns, and NSS feeds relying on the old field name
Client Connector — ZDX Module Release Summary (2021) — 2021-07-28
Jul 28, 2021
· release notes
ZDX Module 2.3.1 for macOS adds adaptive traceroute, URL reuse, and error code logging
Adds support for both TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. and Adaptive probe types for traceroute in Zscaler Client Connector logs Adds the ability to reuse URL connections when requests are redirected to the same domain Adds increased packet count capability of 20 for traceroute probes Adds support for cached protocol usage in traceroute to the egress Adds adaptive traceroute capability to the egress
+1 more
show less
Includes Zscaler Digital Experience (ZDX) error code responses in Zscaler Client Connector logs
6 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-07-23
Jul 23, 2021
· release notes
ZDX adds configurable protocol ports for cloud path probes, SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. admin login, and granular Deep Tracing/Alerts roles.
Adds Edit Protocols for Predefined Cloud Path Probes capability to change the protocol port for predefined cloud path probes after initial configuration Adds SAML Support for ZDX Admin Login to configure SAML authentication for ZDX admins to log in to the ZDX Admin Portal via an IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. like ADFS or Okta Adds ZDX Roles for Deep Tracing, Alerts, and Webhooks to allow admin roles with specific permissions to access, configure, and manage Deep Tracing, Alerts, and Webhooks
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-07-23
Jul 23, 2021
· release notes
ZIA adds FQDN/Host Header mismatch blocking, dashboard drill-downs, and new cloud app categories
Adds Block on URL FQDN & Host Header Mismatch option in Administration > Advanced Settings to block HTTP/S traffic when the request URL FQDN does not match the host header Adds %s{df_hosthead} NSS syntax and new Domain Fronted Host Header column/filter in Web Insights for mismatch detection Renames existing Domain Fronted Hostname field to Domain Fronted SNI in Web Insights logs Adds View Logs and Analyze Chart drill-down options on Microsoft 365 dashboard widgets to jump directly to filtered Insights Logs or Web Insights trend charts Adds new cloud apps to categories (Hosting Providers, Human Resources, Instant Messaging, IT Services, Productivity & CRM Tools, Sales & Marketing, Social Networking, Streaming Media, System & Development, Webmail) for Cloud App Control policies
+1 more
show less
Adds View Logs option on IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Overview dashboard widgets to jump directly to filtered Insights Logs
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The existing field Domain Fronted Hostname is renamed to Domain Fronted SNI in Web Insights logs; dashboards or queries referencing the old name will break.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-07-22
Jul 22, 2021
· release notes
ZPA adds admin portal features for IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. service provider certificate rotation and unlocking locked-out administrators.
Adds ability to rotate the service provider certificate for identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via the ZPA Admin Portal when editing an IdP, using the User SP Certificate Rotation or Admin SP Certificate Rotation fields Adds ability to unlock administrators and API clients who have failed authentication three times directly in the ZPA Admin Portal
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-07-19
Jul 19, 2021
· release notes
ZIA extends AI/ML content categorization to Webmail URLs.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-07-09
Jul 9, 2021
· release notes
ZIA adds account status control for admins/users, location descriptions, and Slack Identity Proxy support.
Adds a Status option to enable or disable Administrators, Partner Administrators, Executive Insight App Administrators, Auditors, and Users via the Admin & Role Management endpoints in the cloud service API Allows adding descriptions to existing and new locations and sub-locations, exposed via Location Management endpoints in the cloud service API Enables configuring Identity Proxy for the Slack cloud app from the Administration > Identity Proxy Settings page of the ZIA Admin Portal
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-07-08
Jul 8, 2021
· release notes
ZPA Private Service Edge adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. policy support.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-07-07
Jul 7, 2021
· release notes
ZPA adds ICMP support in Application Segments and log filtering for reachability checks
Adds ICMP protocol option to Application Segment configuration to allow ping traffic between Client Connector and App Connector Enables filtering Live Logs and User Activity Diagnostic logs by the ICMP protocol
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-07-02
Jul 2, 2021
· release notes
ZIA adds Slack tenant configuration via SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API and collaboration category fields in NSS feeds.
SaaS Security API now supports configuring tenants for Slack, enabling integration with the collaboration application.NSS Feeds output format gains new web log fields under the Collaboration category for SaaS Security Logs: %s{internal_recptnames}, %s{external_recptnames}, %s{ointernal_recptnames}, %s{oexternal_recptnames}, %s{sharedchannel_hostname}, %s{osharedchannel_hostname, %s{sender}, %s{osender}, %s{esender}, %s{channel_name}, and %s{ochannel_name}. SaaS Security API Control policies now support configurable scan schedules for collaboration applications.
3 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2021) — 2021-06-30
Jun 30, 2021
· release notes
ZPA Private Service Edge version 21.146.1 deployed on June 30, 2021, introducing SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. support for policy automation.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-06-25
Jun 25, 2021
· release notes
ZIA adds Microsoft Defender for Endpoint integration, Slack Identity Proxy support, and TLS 1.3 acceleration with new NSS feed fields.
Adds Microsoft Defender for Endpoint partner integration to leverage EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. visibility for Cloud Sandbox-detected malware, enabling endpoint isolation and automated remediation from the ZIA Admin Portal Adds Identity Proxy configuration support for Slack via Administration > Identity Proxy Settings in the ZIA Admin Portal Adds new NSS Feed fields for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Collaboration logs including %s{internal_recptnames}, %s{external_recptnames}, %s{sharedchannel_hostname}, and others under the Collaboration category
3 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-06-23
Jun 23, 2021
· release notes
Client Connector 3.5 adds ZPA ICMP support, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. drop/PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parser configs, and ZDX integration controls.
Adds ICMP protocol support over Zscaler Private Access (ZPA). Adds ability to drop IPv6 traffic via a Client Connector Portal setting. Adds option to disable parallel IPv6 and IPv4 DNS requests for Cisco AnyConnect interoperability. Adds ability to configure device location collection for the Zscaler Digital Experience (ZDX) service. Adds ability to password protect disabling of the ZDX service.
+8 more
show less
Adds ability to disable Pre-Windows Login machine tunnels on all devices via Client Connector Portal. Improves the user interface by consolidating Pre-Windows Login IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. authentication and machine tunnel diagnostics as Zscaler Options . Adds ability to stop the machine tunnel for Pre-Windows Login troubleshooting. Removes the need to restart the tunnel when switching to Z-Tunnel 2.0 if not using a filter driver. Adds option to use a new PAC parser before the legacy parser is deprecated. Adds ability to set separate passwords for disabling Zscaler Internet Access (ZIA) versus exiting the app. Enables the Client Connector to continue running when an RDP RDP A Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. session disconnects. Supports old and new thumbprints for antivirus posture checks.
13 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-06-18
Jun 18, 2021
· release notes
ZDX Score metric is now available as a Rule Type within the alerting configuration UI.
Alert rules can now monitor changes in the ZDX Score.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-06-18
Jun 18, 2021
· release notes
ZIA adds Microsoft Defender for Endpoint integration, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. ${FILENAME} macro, and NSS fields for Amazon S3 and MS Teams.
Adds Microsoft Defender for Endpoint partner integration providing EDR EDR Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. visibility, endpoint isolation, and automated remediation workflows triggered by Cloud Sandbox detections Adds new ${FILENAME} macro to DLP Notification Templates to specify the name of the file that triggered a DLP rule Adds Amazon S3 and Microsoft Teams support to SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API for tenant configuration, control policies, scan schedules, Insights, logs, and reports Adds new Public Cloud Storage application category to NSS feeds for SaaS Security API supporting Amazon S3 and Microsoft Teams Adds 24 new web log fields to NSS Feed outputs under the Public Cloud Storage category (e.g. %d{bucketid}, %s{filename}, %s{fullurl})
+1 more
show less
Adds Google Workspace and GitHub application support for SaaS Security Posture Control policies and reports
6 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-06-17
Jun 17, 2021
· release notes
New capability to export Application Segment configurations via the ZPA Admin Portal.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-06-11
Jun 11, 2021
· release notes
Adds Adaptive mode protocol option for probe configuration in ZDX.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-06-11
Jun 11, 2021
· release notes
ZIA adds ${FILENAME} macro for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. notifications and Google Workspace/GitHub support for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Control.
└──▷ USE IT
Include the specific file name in DLP alert emails when a policy is triggered.
${FILENAME} is now available as a macro in DLP Notification Templates to include the name of the file that triggered the ruleSaaS Security Posture Control now supports configuring tenants for Google Workspace Google Workspace and GitHub are added to the SaaS Security Posture Control policy and SaaS Security Posture Report
3 details in Everything
Client Connector — ZDX Module Release Summary (2021) — 2021-06-07
Jun 7, 2021
· release notes
ZDX Module 2.3 adds TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. /Adaptive traceroute support and ZDX error codes in logs.
Adds support for TCP and Adaptive probe types for traceroute in ZDX Module 2.3 Includes Zscaler Digital Experience (ZDX) error code responses in Zscaler Client Connector logs
2 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-06-04
Jun 4, 2021
· release notes
Adds device location collection, Microsoft Defender posture check, and machine tunnel disable option to Client Connector Portal 3.17.7
Supports collection of a user’s device location information if Zscaler Digital Experience (ZDX) has been enabled on the device. Includes option in Zscaler Service Entitlement to disable the machine tunnel for all devices.
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-06-02
Jun 2, 2021
· release notes
Zscaler Client Connector 1.8 for Android adds remote log fetching and packet capture packet capture A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. capabilities.
Adds fetch logs remotely option for enrolled devices to allow troubleshooting without user intervention Adds packet capture capability for network traffic troubleshooting
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-05-28
May 28, 2021
· release notes
ZDX enhances user dashboard with persistent selections, multi-device details, filter separation, and detailed cloud path metrics
Retains device and Device Health metric selections across navigation and login on the User page Displays information for multiple devices plus additional network, hardware, and software details in the User Devices section Separates filters between the Probe configuration page and the Users dashboard page so they no longer carry over
3 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-05-28
May 28, 2021
· release notes
Zscaler Client Connector Portal 3.17.7 adds device location collection, Defender posture check, and machine tunnel disable option.
Supports collection of a user’s device location information if Zscaler Digital Experience (ZDX) has been enabled on the device Supports Microsoft Defender posture check Includes option in Zscaler Service Entitlement to disable the machine tunnel for all devices Improves Certificate Trust posture check by adding Name and Expiry fields for validation General Availability builds can now be enabled under the app store’s New Releases tab without auto-update restrictions
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-05-28
May 28, 2021
· release notes
ZIA adds ServiceNow Identity Proxy support and Backup & Restore enhancements including Golden Restore Points.
Adds Administration > Identity Proxy Settings page in the ZIA Admin Portal for configuring Identity Proxy for ServiceNow. Introduces Golden Restore Point marking capability within the Backup & Restore feature. Adds a new Backup Configuration tab to schedule automatic creation of restore points.
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-05-21
May 21, 2021
· release notes
ZIA adds Cloud Sandbox Submission API and VMware SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. URL field
Adds POST /zscsb/submit endpoint to the Cloud Sandbox Submission API for submitting raw or archive files for analysis Adds a new VMware SD-WAN SSO URL field in Partner Integrations
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-05-21
May 21, 2021
· release notes
Zscaler Client Connector 3.2.3.17 for macOS adds ZDX opt-out, ARP ARP A network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. cache clearing, DNS priority, and ifscope route policy options
Adds geolocation_enabled (or equivalent privacy setting) to the macOS policy to opt out of collecting Zscaler Digital Experience (ZDX) geolocation information. Adds an option in the macOS policy to clear Address Resolution Protocol (ARP) cache on tunnel start. Adds a new option in the macOS policy to configure DNS names or IP addresses in order of priority. Adds a new ifscope route setting in the macOS policy setup for routing to the default interface.
4 details in Everything
Client Connector — ZDX Module Release Summary (2021) — 2021-05-17
May 17, 2021
· release notes
ZDX Module 2.2.0.13 adds traceroute support for ZPA brokers and refines DNS resolution metrics.
Adds traceroute capability to the Zscaler Private Access (ZPA) broker probe Updates ZDX page fetch probe DNS resolution metric to report only network time
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-05-17
May 17, 2021
· release notes
Zscaler Client Connector 1.0 for Linux released; macOS policy adds DNS priority, ifscope routing and ZDX opt-out.
└──▷ HOW TO FIND IT
Deploy the new Linux client by enabling it via your organization's Zscaler account management interface.
📍 Contact the Zscaler Account team if you want this release enabled for your organization.
Releases Zscaler Client Connector 1.0 for Linux with support for Z-Tunnel 1.0, Z-Tunnel 2.0, ZIA and ZPA. Adds option in the macOS policy to configure DNS names or IP addresses in order of priority. Adds option in the macOS policy to bind ifscope routing to the default interface. Adds option in the macOS policy for Zscaler Client Connector to clear Address Resolution Protocol (ARP ARP A network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. ) cache.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-05-14
May 14, 2021
· release notes
Adds Cloud Sandbox Submission API for automated file analysis submissions to ZIA
Adds POST /zscsb/submit endpoint in the new Cloud Sandbox Submission API to allow submitting up to 100 files (raw or archives like ZIP/GZIP) per day for analysis, with support for forcing re-analysis of existing verdicts Adds a new field for the VMware SD-WAN SD-WAN Software-defined wide-area networking: an approach that decouples WAN routing logic from physical hardware, letting operators centrally control traffic paths across MPLS, broadband, and LTE links to reduce cost and improve resilience. SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. URL in Partner Integrations, enabling direct navigation from the Location Management page to the VMware SD-WAN Portal
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-05-07
May 7, 2021
· release notes
ZDX May 2021 adds per-leg latency graphs, hop service provider info, deleted user search results, and dashboard score rendering optimization
Adds selectable latency graphs per leg in the Cloud Path section of the User page Displays service provider information for hops in Cloud Path Hop View and Command Line View Shows geo information for devices, Zscaler locations, and Zscaler nodes in Hop and Command Line Views Includes recently deleted user profiles in User Search results and search history Optimizes ZDX score processing on the Users Dashboard for faster loading
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-05-07
May 7, 2021
· release notes
ZIA adds Cloud Sandbox Submission API endpoint, multi-cluster load sharing, IDM DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. engine, and redesigned SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policy engine.
Adds the POST /zscsb/submit Cloud Sandbox Submission API endpoint for submitting raw or archive files (ZIP, GZIP) to cloud sandbox analysis. Introduces Multi-Cluster Load Sharing, allowing ingress traffic via a single Virtual IP (VIP VIP A Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. ) to be served by any participating public service edge cluster instance. Adds Indexed Document Match (IDM) as a new Data Loss Prevention mechanism, using the Index Tool to create document repositories for identifying sensitive data in outbound traffic. Redesigns the SSL Inspection policy engine into a centralized rule-based system with 12 source/destination criteria, replacing previous global settings and deprecated API endpoints GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls. Extends Cloud Service API with full CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. support for Firewall Policies resources (POST, PUT, DELETE on /firewallFilteringRules, /ipDestinationGroups, /ipSourceGroups, /networkServices, /networkServiceGroups) and traffic forwarding resources (GET, POST, PUT, DELETE on /greTunnels and /staticIP).
+10 more
show less
Changes the cloud service API base URL from admin.<cloud>/api/v1 to zsapi.<cloud>/api/v1. Adds Isolate as a new Action option in URL Filtering policy rules for Cloud Browser Isolation integration, allowing selection of isolation profiles from the Cloud Browser Isolation Portal. Adds new Network Security Services (NSS) URL Category field values to ensure consistency with ZIA Admin Portal Web Insights. Enables Cloud NSS Feeds for instant cloud-to-cloud log streaming into SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. without deploying an NSS VM. Adds support for DNS over HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. , TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , and UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. as protocol types in DNS Filtering Rules. Adds Dynamic DNS Host and Military as new predefined URL categories. Allows configuration of User Agent criteria in URL Filtering and Cloud App Control policies. Adds new location types (Corporate user traffic, Guest Wi-Fi traffic, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. traffic, Server traffic) on the Locations or Sub-Locations page. Adds Traffic Increase and Traffic decrease as new events for triggering System Alerts. Enables self-provisioning of GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnels and static IP addresses via the Administration > Static IPs & GRE Tunnels wizards in the ZIA Admin Portal or cloud service API.
15 details in Everything
└──▷ BREAKING ON UPGRADE
! The base URL for the cloud services API is changed from admin.<Zscaler Cloud Name>/api/v1 to zsapi.<Zscaler Cloud Name>/api/v1, requiring script updates.! The API endpoints GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls are removed; SSL bypass lists must now be managed via destination group or a custom URL category.! Location Management parameters sslScanEnabled and zappSSLScanEnabled no longer have an effect on SSL policy in the API payload, though they remain supported for backwards compatibility until future removal.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-05-06
May 6, 2021
· release notes
SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attributes for policy evaluation require reauthentication; ZPA API fetches records by customerId fixed.
Requires user reauthentication in Zscaler Client Connector when SCIM Attributes are enabled for Policy on an IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. , ensuring policies with SCIM criteria are evaluated correctly after reauth.
1 detail in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-04-30
Apr 30, 2021
· release notes
Client Connector 3.17.6.76 adds CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. posture checks, IPv4-over-IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. , CrowdStrike risk scores, remote logs, and registry PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. paths.
registry_path option in forwarding/app profiles sets the PAC URL sourceZPA reauthentication notifications configurable under System Tray Notification Settings tabCrowdStrike risk score posture checks supportedblock unreachable domains option added for Z-Tunnel 1.0 and TWLP in forwarding profileremote log fetch for enrolled devices without user intervention
+5 more
show less
CRL check enabled in posture profiles to detect revoked certificatesenable IPv4 over IPv6 option in Windows app profile settingfallback to TLS or Z-Tunnel 1.0 for ZIA on Z-Tunnel 2.0 failure in forwarding profileIPv6 addresses supported in trusted network and forwarding profile configurations multiple certificate thumbprints supported for device postures
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-30
Apr 30, 2021
· release notes
ZIA adds Cloud NSS Feeds, Sandbox Submission API, self-provisioned GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. /static IPs, redesigned SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. policy engine, and DNS protocol controls.
Adds Cloud NSS Feeds for cloud-to-cloud log streaming to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. without deploying an NSS VM Adds POST /zscsb/submit API endpoint to submit files to Cloud Sandbox via REST Enables self-provisioning of GRE tunnels and static IPs via Administration portal or API endpoints /greTunnels and /staticIP Replaces global SSL inspection settings with a rule-based SSL Inspection Policy engine supporting 12 criteria Adds UDPUDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , TCPTCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , and DNS over HTTPS as selectable protocol types in DNS Filtering Rules
+13 more
show less
Adds Isolate action to URL filtering policy rules for Cloud Browser Isolation integration Adds Indexed Document Match (IDM) capability for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. using uploaded document fingerprints Adds Shadow IT Report showing sanctioned/unsanctioned app usage and risk indexes Adds Traffic Increase and Traffic decrease as new triggers for System Alerts Enables PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file verification status viewing (Verified , Error-Accepted , Unverified ) on Administration > Hosted PAC Files page Adds predefined NAT rule Zscaler Trusted DNS Resolver to control DNS traffic forwarding or redirection Extends Locations/Sub-Locations type selection to include IoT traffic, Server traffic , Guest Wi-Fi traffic Adds new URL categories Dynamic DNS Host and Military for filtering Enables user agent selection in URL Filtering and Cloud App Control policies Increases DLP Insights Logs capacity to 16 dictionaries and 8 engines per transaction Allows variable length primary fields (up to 5 lengths) for Alphanumeric/Numeric EDM data types Adds SSL Policy Reason weblog field capturing specific SSL inspection actions in Web Logs and NSS Changes cloud service API base URL from admin.<cloud>/api/v1 to zsapi.<cloud>/api/v1
18 details in Everything
└──▷ BREAKING ON UPGRADE
! The cloud service API base URL has changed from admin.<Zscaler Cloud Name>/api/v1 to zsapi.<Zscaler Cloud Name>/api/v1; existing scripts must update the base URL.! SSL Inspection Settings resources (GET /sslSettings/exemptedUrls, POST /sslSettings/exemptedUrls) are removed from the API; management must use destination group or custom URL category endpoints.
Client Connector — Release Upgrade Summary (2021) — 2021-04-23
Apr 23, 2021
· release notes
Zscaler Client Connector 3.17.6.76 adds registry path config, CrowdStrike posture checks, and remote log fetching
PAC URL can now be set via a registry path in forwarding and app profiles.Adds CRL check in posture profile to detect revoked certificates. Supports CrowdStrike risk score-based posture checks. Enables blocking unreachable domains for Z-Tunnel 1.0 and TWLP in forwarding profile.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-23
Apr 23, 2021
· release notes
ZIA adds Golden Restore Points and automated restore point scheduling via Backup Configuration tab
Adds the ability to mark a restore point as a Golden Restore Point for critical configuration preservation Enables scheduled automatic creation of restore points in the new Backup Configuration tab
2 details in Everything
Client Connector — ZDX Module Release Summary (2021) — 2021-04-19
Apr 19, 2021
· release notes
Adds system notifications for power state changes and resume/suspend in ZDX Module 2.1.0.7 for macOS
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-04-16
Apr 16, 2021
· release notes
ZDX adds deep tracing raw metrics visualization and admin location management UI
└──▷ HOW TO FIND IT
View detailed, unaggregated metrics for a deep tracing session to diagnose specific latency issues.
📍 Viewing Deep Tracing Session Results
Access the location management settings from the ZDX admin interface.
📍 Administration › Location Management
Deep Tracing session results charts now display raw metrics without aggregation Admins can view the Location Management page in the ZDX Admin Portal
2 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-04-16
Apr 16, 2021
· release notes
Zscaler Client Connector 3.17.6.74 adds Z-Tunnel fallback, CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. checks, CrowdStrike posture and remote logs
Adds PAC_URL registry path setting in forwarding and app profiles to control proxy configuration source Enables Zscaler Private Access (ZPA) reauthentication notifications via System Tray Notification Settings tab or the More screen Adds CrowdStrike risk score-based posture checks as a supported posture method Adds ability to block unreachable domains for Z-Tunnel 1.0 and Tunnel with Local Proxy (TWLP) in forwarding profile Enables remote log fetching for enrolled devices without user intervention
+5 more
show less
Adds Certificate Revocation List (CRL) check option in posture profiles to detect revoked certificates Adds IPv4 over IPv6 toggle in Windows app profile settings Adds fallback to TLS or Z-Tunnel 1.0 for Zscaler Internet Access (ZIA) on Z-Tunnel 2.0 failure in forwarding profile Supports IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses in trusted network and forwarding profile configurations Supports multiple certificate thumbprints for device postures
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-16
Apr 16, 2021
· release notes
ZIA introduces cloud NSS feeds, sandbox PDF/JSON export, self-provisioning GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. /static IPs, rule-based SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection, and firewall API CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. .
Adds Cloud NSS Feeds for instant stream of ZIA logs directly to a cloud SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. without an NSS VM Sandbox Activity and Malicious Files reports can now be exported as PDF or JSON/CSV and scheduled for weekly email delivery Self-provisions static IP addresses and GRE tunnels via the Add Static IP Configuration wizard or cloud service API endpoints (POST /staticIP, POST /greTunnels) DNS Filtering Rules now support Protocol Type selection of UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , or DNS over HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. , with logs filterable by Protocol Type in DNS Insights Enhanced Cloud Browser Isolation integration adds an Isolate action to URL filtering policies, linking to isolation profiles from the Zscaler Cloud Browser Isolation Portal
+9 more
show less
Locations and Sub-Locations can now be defined by primary traffic type: Corporate user traffic, Guest Wi-Fi traffic, IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. traffic, or Server traffic Adds new predefined URL categories Dynamic DNS Host and Military Indexed Document Match (IDM) allows fingerprinting critical documents for DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. using the Index Tool System Alerts can now trigger on Traffic Increase and Traffic decrease events Administration > Hosted PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. Files page shows verification status (Verified , Error-Accepted , Unverified ) for Zscaler-hosted PAC files Adds predefined NAT rule Zscaler Trusted DNS Resolver to forward or redirect standard DNS traffic Shadow IT Report shows sanctioned/unsanctioned applications, user counts, risk index, and certifications SSL Inspection policy engine redesign replaces global settings with a centralized rule-based engine supporting 12 criteria; new weblog field SSL Policy Reason added ZIA Admin Portal interface supports personalized color themes
14 details in Everything
└──▷ BREAKING ON UPGRADE
! Base URL for the cloud service API changed from admin.<Zscaler Cloud Name>/api/v1 to zsapi.<Zscaler Cloud Name>/api/v1.! Removed API endpoints GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls; SSL bypass lists must now be managed via destination group or custom URL category.! Deprecated API parameters sslScanEnabled and zappSSLScanEnabled no longer have an effect on SSL policy.! Global SSL inspection settings such as Enable SSL Inspection , Enforce Zscaler Client Connector SSL Setting , and others under Policy > SSL Inspection were removed; must be configured via the new rule-based SSL Inspection policy engine.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-12
Apr 12, 2021
· release notes
ZIA adds Local Browser Rendering for Cloud Browser Isolation to push external links out of the isolation session.
Cloud Browser Isolation allows admins to configure whether hyperlinks clicked by users are rendered in the isolation browser or the user's local browser.
1 detail in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-04-09
Apr 9, 2021
· release notes
Zscaler Client Connector 3.17 adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, CrowdStrike posture checks, Z-Tunnel fallbacks, and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. registry path configuration.
Forwarding Profile now supports configuring a custom registry path for the PAC URL in both forwarding and app profilesSystem Tray Notification Settings tab allows configuration of ZPA reauthentication notifications, overridable via the app's More screenPosture profile supports CrowdStrike risk score-based posture checks for device health assessment Forwarding Profile can now block unreachable domains for Z-Tunnel 1.0 and Tunnel with Local Proxy (TWLP) deploymentsNew feature to fetch logs remotely for enrolled devices without requiring user intervention
+5 more
show less
Posture profile includes a Certificate Revocation List (CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. ) check to detect revoked certificates Windows app profile setting enables IPv4 over IPv6 configuration Forwarding Profile can fall back to TLS or Z-Tunnel 1.0 for Zscaler Internet Access (ZIA) in case of Z-Tunnel 2.0 failureConfiguration supports IPv6 addresses in both trusted network and forwarding profile settings Device postures now support multiple certificate thumbprints
10 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-04-09
Apr 9, 2021
· release notes
ZPA Admin Portal warns when application definitions near the 6000 limit
Client Connector — ZDX Module Release Summary (2021) — 2021-04-08
Apr 8, 2021
· release notes
ZDX Module 2.2 adds ZPA broker traceroute support and refines probe metric calculations.
Supports traceroute to the Zscaler Private Access (ZPA) broker Changes the ZDX page fetch probe metrics calculations by excluding discovery time from DNS resolution but including time only for system proxy PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. parsing
2 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-04-02
Apr 2, 2021
· release notes
ZDX adds hierarchical location filtering, cloud path latency/error visualization, and smooth ZDX scoring to the UI.
Adds Ongoing alerts and Alert History tabs to organize alert details on the Alerts page Adds hierarchical display for Active Geolocations filter in the ZDX Dashboard location selector Adds Regions by ZDX Score map to the Applications page with filtering capabilities Enables viewing differential latency and error icons in Cloud Path from Zscaler Client Connector to ZPA on the Users Dashboard Adds Smooth ZDX Score graph in the User page that uses historical data to reduce short-term variations
5 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-04-02
Apr 2, 2021
· release notes
Zscaler Client Connector Portal 3.17.6.73 adds CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. posture checks, remote log fetching, and ZPA notification configs
Adds CRL check to posture profile for detecting revoked certificates. Adds option to set a registry path for the PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URL in the forwarding profile and app profiles. Adds option to fetch logs remotely for enrolled devices without user intervention. Adds CrowdStrike risk score-based posture checks support. Adds option to configure ZPA reauthentication notifications under the System Tray Notification Settings tab.
+1 more
show less
Adds multiple certificate thumbprints support for device postures.
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-04-02
Apr 2, 2021
· release notes
ZIA adds Cloud NSS Feeds, self-provisioned GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. /static IPs, redesigned SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. policy engine, and new API endpoints.
Adds Cloud NSS Feeds for cloud-to-cloud log streaming to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. without a VM Enables self-provisioning of GRE Tunnels and Static IP Addresses via the Admin Portal or API Introduces a rule-based SSL Inspection Policy Engine replacing previous global settings Adds new cloud service API endpoints for Firewall Policies (/firewallFilteringRules) and Traffic Forwarding (/greTunnels, /staticIP) Changes the base URL for the cloud services API from admin.<cloud>/api/v1 to zsapi.<cloud>/api/v1
+11 more
show less
Adds Dynamic DNS Host and Military to predefined URL categories Allows selection of User Agent in URL Filtering and Cloud App Control policies Adds Isolate action option to URL filtering policy rules for Cloud Browser Isolation integration Enables creation of DNS Filtering Rules with protocol types UDPUDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , TCPTCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , or DNS over HTTPS Supports file types .vbs, .ps1, and .hta in Sandbox Policy rules Increases Insights Logs to display up to 16 DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries and 8 DLP engines per transaction Adds support for primary fields with up to 5 separate variable lengths for Alphanumeric and Numeric EDM data types Adds Traffic Increase and Traffic decrease events to trigger System Alerts Adds Shadow IT Report showing sanctioned/unsanctioned applications and risk index Adds verification status display for hosted PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files (Verified , Error-Accepted , Unverified ) Allows selection of location types (Corporate user traffic , Guest Wi-Fi traffic , IoT traffic, Server traffic ) on Locations/Sub-Locations page
16 details in Everything
└──▷ BREAKING ON UPGRADE
! The API endpoints GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls are no longer supported; use destination group or a custom URL category for SSL bypass lists.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-03-31
Mar 31, 2021
· release notes
ZPA Private Access adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. API group retrieval for specific users
Adds GET /scim/v2/Users/{id}/Groups endpoint to the SCIM API in ZPA to list groups for a specific user
1 detail in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-03-26
Mar 26, 2021
· release notes
Zscaler Client Connector 3.17.6.73 adds PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. registry path, CrowdStrike posture checks, CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. validation, and remote log fetching.
Adds registry path option for PAC URL in forwarding and app profiles Adds support for CrowdStrike risk score-based posture checks Adds CRL check in posture profile to detect revoked certificates Adds option to block unreachable domains for Z-Tunnel 1.0 and TWLP in the forwarding profile Adds capability to fetch logs remotely for enrolled devices without user intervention
+5 more
show less
Adds IPv4 over IPv6 enable option in Windows app profile setting Adds fallback to TLS or Z-Tunnel 1.0 for ZIA if Z-Tunnel 2.0 fails in the forwarding profile Adds support for IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. addresses in trusted network and forwarding profile configurations Adds support for multiple certificate thumbprints for device postures Adds configuration of ZPA reauthentication notifications under System Tray Notification Settings tab
10 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-03-26
Mar 26, 2021
· release notes
Client Connector 3.4 (Windows) adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. NAT64 support, remote log fetching, and Z-Tunnel fallback customization.
Adds native IPv6 support for TWLP, Enforce Proxy, and None modes using NAT64 Adds option to prefer IPv4 over IPv6 for outgoing traffic Adds option to fetch logs remotely for enrolled devices without user intervention Adds ability to authenticate Pre-Windows Login machine tunnel traffic using the domain IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. Adds support for Pre-Windows Login machine tunnel with external proxy
+2 more
show less
Allows customization of fallback behavior when falling back from Z-Tunnel 2.0 to 1.0 Adds option to configure ZPA reauthentication notifications under System Tray Notification Settings tab
7 details in Everything
└──▷ BREAKING ON UPGRADE
! Upgrades to Zscaler Client Connector version 3.4 from earlier versions are not supported on devices that have IPv6-only connection.! Customers using the Zscaler government cloud should not use this Zscaler Client Connector version.
Private Access (ZPA) — App Connector Release Summary (2021) — 2021-03-26
Mar 26, 2021
· release notes
App Connector 21.67.1 supports Docker deployments and raises systemd file descriptor limits.
Raises the LimitNOFILE value in the systemd file from 100,000 to 500,000
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-03-23
Mar 23, 2021
· release notes
ZPA adds customer-facing API for application segments and policies, plus new session termination capability.
Adds customer-facing APIs for managing application segments and policies via the ZPA API endpoint Adds ability to terminate Admin sessions created using an API key or via the Admin Portal through the Client Sessions management feature Improves load balancing of application requests across App Connectors by accounting for CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. , memory, and UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port consumption using a PMF algorithm
3 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-03-19
Mar 19, 2021
· release notes
Zscaler Client Connector Portal 3.17.6.72 adds registry path config, ZPA reauth notifications, CrowdStrike posture checks, and CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. validation.
Adds registry_path option for the PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URL in the forwarding profile and app profiles to define where the proxy configuration is stored on disk Adds ability to configure Zscaler Private Access (ZPA) reauthentication notifications under the System Tray Notification Settings tab Adds support for CrowdStrike risk score-based posture checks in device compliance evaluation Adds option to block unreachable domains for Z-Tunnel 1.0 and Tunnel with Local Proxy (TWLP) in the forwarding profile Adds remote log fetching capability for enrolled devices without user intervention
+5 more
show less
Adds Certificate Revocation List (CRL) check in posture profile to detect revoked certificates Adds option to enable IPv4 over IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. in the Windows app profile setting Adds fallback to TLS or Z-Tunnel 1.0 for Zscaler Internet Access (ZIA) in the forwarding profile when Z-Tunnel 2.0 fails Adds support for IPv6 addresses in trusted network and forwarding profile configurations Adds support for multiple certificate thumbprints for device postures
10 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-03-19
Mar 19, 2021
· release notes
ZIA adds Cloud NSS Feeds, DNS protocol filtering, sandbox report exports, and a rule-based SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection engine replacing global settings.
Adds Cloud NSS Feeds for cloud-to-cloud log streaming to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. without deploying an NSS VM Adds UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , and DNS over HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. protocol types in DNS Filtering Rules, with Protocol Type filtering in DNS Insights and a new DNS Protocol Distribution widget in Dashboard > DNS Overview Adds Isolate action to URL filtering policy rules for Cloud Browser Isolation integration with automatic auth pass-through Adds Dynamic DNS Host and Military predefined URL categories Adds Traffic Increase and Traffic decrease system alert events
+8 more
show less
Adds PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file verification status viewing (Verified , Error-Accepted , Unverified ) on Administration > Hosted PAC Files page Adds Zscaler Trusted DNS Resolver predefined NAT rule for standard DNS traffic control Adds Shadow IT report showing sanctioned/unsanctioned apps, user counts, categories, risk index, and certifications Redesigns SSL inspection policy engine into a centralized rule-based system with 12 criteria, replacing all previous global SSL settings Adds SSL Policy Reason weblog field capturing actions like Blocked, Inspected, O365 bypass, etc. Removes sslScanEnabled and zappSSLScanEnabled Location Management parameters from API; they no longer affect SSL policy Removes GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls endpoints from the cloud service API Adds CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. API support for Firewall Policies resources including /firewallDnsRules, /firewallFilteringRules, /firewallIpsRules, /ipDestinationGroups, /ipSourceGroups, /networkServices, /networkServiceGroups
13 details in Everything
└──▷ BREAKING ON UPGRADE
! The sslScanEnabled and zappSSLScanEnabled Location Management parameters no longer have an effect on SSL policy and will be removed in a future release.! The API endpoints GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls are no longer supported; manage SSL bypass lists via destination group or custom URL category instead.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-03-18
Mar 18, 2021
· release notes
ZIA adds ServiceNow tenant support, Golden Restore Point scheduling, Cloud NSS Feeds for SIEM SIEM Security information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. streaming, and variable-length EDM fields.
Adds SaaS Security ITSM application category and new ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. tab in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Log Filters for NSS Feeds Adds new NSS Feed output fields for SaaS Security logs: %d{num_internal_collab}, %d{num_external_collab}, %s{objectname}, %s{objecttype}, %s{file_msg_id}, %s{filetypecategory}, %s{hostname}, %s{ohostname}, %s{ofullurl}, %s{internal_collabnames}, %s{external_collabnames}, %s{ointernal_collabnames}, %s{oexternal_collabnames}, %d{filesize}, %s{file_msg_mod_time}, %s{filepath}, %s{component}, and %s{sha} Allows scheduling automatic restore points via the new Backup Configuration tab and marking a point as a Golden Restore Point Introduces Cloud NSS Feeds for direct cloud-to-cloud log streaming to SIEMs SIEMs Security Information and Event Management platforms that collect, normalize, and correlate log data across an infrastructure so cyber tools can detect threats and trigger alerts from a central point. without an NSS VM
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The SaaS Security API page is renamed to SaaS Security API Control! The SaaS Security Posture Policy page is renamed to SaaS Security Posture Control
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-03-16
Mar 16, 2021
· release notes
ZIA adds IoT IoT A collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. and Server traffic types to Locations/Sub-Locations and three new Data Center log fields for NSS feeds.
Adds IoT and Server location types for traffic classification in the UI Adds %s{datacenter}, %s{datacentercity}, and %s{datacentercountry} fields to NSS Feed outputs for Data Center web logs
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-03-15
Mar 15, 2021
· release notes
ZIA adds ServiceNow tenant configuration and new ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. -specific fields to NSS feeds.
Adds the ability to configure tenants for ServiceNow in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API Control. Adds new ITSM-specific web log fields (%d{num_internal_collab}, %s{objectname}, etc.) to NSS Feeds under the SaaS Security ITSM category.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-03-15
Mar 15, 2021
· release notes
ZPA introduces App Connector caching and Machine Tunnel support on PSEs
App Connector selection decisions are now cached by ZPA Public Service Edges based on earlier application requests ZPA Private Service Edges now support Machine Tunnels
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-03-15
Mar 15, 2021
· release notes
Zscaler Client Connector 1.8.3 adds device ownership posture checks and refines UI/login behavior on iOS.
Adds device ownership posture checks at the time of installation VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. icon no longer displays for non-MDM MDM Mobile device management, centrally configuring and managing enrolled devices. Administrators use it to apply settings, distribute applications and enforce device security policies. deployments upon user logout
2 details in Everything
Private Access (ZPA) — ZPA Private Service Edge Release Summary (2021) — 2021-03-12
Mar 12, 2021
· release notes
ZPA PSE 21.51.1 introduces Machine Tunnels, allowing the edge to support machine-level connectivity patterns.
Client Connector — Release Upgrade Summary (2021) — 2021-03-12
Mar 12, 2021
· release notes
Zscaler Client Connector 3.17.6.71 adds PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. URL registry path config, IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support, Z-Tunnel fallback, and multiple cert thumbprints.
registry path setting in forwarding profile and app profiles allows setting a custom registry path for the PAC URLIPv6 addresses are now supported in trusted network and forwarding profile configurations Forwarding profile includes option to fall back to TLS or Z-Tunnel 1.0 for ZIA in case of Z-Tunnel 2.0 failure Posture profile adds Certificate Revocation List (CRL CRL A Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. ) check to detect revoked certificates Device postures now support multiple certificate thumbprints
+3 more
show less
Windows app profile includes option to enable IPv4 over IPv6 Blocking unreachable domains for Z-Tunnel 1.0 and Tunnel with Local Proxy (TWLP) is now available in the forwarding profile System Tray Notification Settings tab allows configuring ZPA reauthentication notifications
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-03-10
Mar 10, 2021
· release notes
Admin Portal gains table filtering for Access Policy, Client Forwarding Policy, and Timeout Policy
Adds rule criteria filtering to the Access Policy table in the Admin Portal Adds rule criteria filtering to the Client Forwarding Policy table in the Admin Portal Adds rule criteria filtering to the Timeout Policy table in the Admin Portal
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-03-08
Mar 8, 2021
· release notes
ZIA adds ServiceNow tenant configuration, ITSM ITSM IT Service Management: a framework of practices for delivering and supporting IT services, covering ticketing, change control, and incident response. Cyber tools integrate with it to automate alert-to-ticket workflows. categories to reports/logs, and new NSS feed fields for SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security.
Adds SaaS Security ITSM category to NSS feeds with corresponding log filters Shows ITSM application categories in the SaaS Assets Summary and SaaS Assets Reports Renames SaaS Security API page to SaaS Security API Control and SaaS Security Posture Policy to SaaS Security Posture Control
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-03-08
Mar 8, 2021
· release notes
ZPA adds IPv4-only DNS resolution for App Connectors and SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attribute processing enhancements
Configures App Connector group to perform IPv4 only DNS resolution checks for applications. Enhances processing of browser access application requests when access policies use SCIM attributes. Improves App Connector efficiency for reporting Application reachability information.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-03-05
Mar 5, 2021
· release notes
ZDX adds cloud path error icons on Users page and paginated user search results
Adds Cloud Path Error Messages in the Users Page: error icons display in the Cloud Path section and a link to view details Enhances User Search in the ZDX Admin Portal to return the 10 most relevant results with a Load More option for pagination
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-02-26
Feb 26, 2021
· release notes
ZPA Admin Portal adds trend charts to the User Activity diagnostics view.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-02-24
Feb 24, 2021
· release notes
ZIA adds self-provisioned GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. /static IP via API, new SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policy engine with rule-based criteria, and Shadow IT report.
Adds GET /greTunnels, POST /greTunnels, PUT /greTunnels/{id}, DELETE /greTunnels/{id} endpoints to the ZIA cloud service API for self-provisioning GRE tunnels and static IPs. Introduces a new rule-based SSL Inspection Policy engine in the Admin Portal, replacing global settings with 12 granular criteria (source/destination/user/platform) evaluated top-down. Adds SSL Policy Reason as a new weblog field in Web Insights and NSS logs to capture specific SSL inspection actions (e.g., Inspected , Blocked ). Enables Isolate as a new Action option in URL filtering policy rules for Cloud Browser Isolation integration. Adds Protocol field to DNS Control Policy rules, allowing control over DNS over HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. , TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , and UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. traffic.
+7 more
show less
Adds Dynamic DNS Host and Military as new predefined URL categories for traffic classification. Increases DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. visibility in Insights Logs to display up to 16 dictionaries and 8 engines per transaction (previously 4 and 1). Introduces Indexed Document Match (IDM) for fingerprinting critical documents in outbound DLP policies using an Index Tool-generated repository. Adds Shadow IT Report to the Admin Portal showing sanctioned/unsanctioned app usage, risk index, and certifications. Adds user agent selection as a new criterion in URL Filtering and Cloud App Control policy rules. Changes the base URL for ZIA cloud service API from admin.<cloud_name>/api/v1 to zsapi.<cloud_name>/api/v1. Removes GET /sslSettings/exemptedUrls, POST /sslSettings/exemptedUrls, sslScanEnabled, and zappSSLScanEnabled parameters from the cloud service API for SSL bypass management.
12 details in Everything
└──▷ BREAKING ON UPGRADE
! The base URL for ZIA cloud service API has changed from admin.<Zscaler Cloud Name>/api/v1 to zsapi.<Zscaler Cloud Name>/api/v1.
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-02-23
Feb 23, 2021
· release notes
ZPA enables pre-Windows login access for Windows devices through the new Machine Tunnel client type and Machine Groups configuration.
Introduces Machine Tunnel client type allowing Windows device access to internal apps before user login
1 detail in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-02-22
Feb 22, 2021
· release notes
Adds Pre-Windows Login machine tunneling and proxy/DNS profile settings to Client Connector 3.2.0.87
Adds support for machine tunneling to ZPA resources before login to Windows (Pre-Windows Login) Allows saving and restoring system proxy settings via the app profile Adds support for DNS domains via the app profile
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-02-19
Feb 19, 2021
· release notes
ZDX adds Deep Tracing for macOS and predefined app configs for Teams/Zoom
Enables Deep Tracing sessions for macOS devices in the ZDX Admin Portal Adds Microsoft Teams and Zoom as predefined applications with automatic web/cloud path probe onboarding
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-02-08
Feb 8, 2021
· release notes
ZPA adds time zone selection to Admin Portal, session pinning for admins, and 5-minute intervals for dashboard filters
Adds time zone selection in account settings to control timestamp and interval display in the ZPA Admin Portal Adds Session Pinning setting when creating administrators to bind session tokens to the issued user (enabled by default) Improves Time Range filter on Application Dashboard and Users Dashboard to support Custom Range in 5-minute increments
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-02-05
Feb 5, 2021
· release notes
ZDX release adds admin password management and enhances cloud path visibility for egress locations.
ZDX admins can now change their password from the Account Page Cloud Path section of the Users Dashboard shows location of egress, ZIA Public Service Edge, and destination in Hop View
2 details in Everything
Client Connector — Release Upgrade Summary (2021) — 2021-02-05
Feb 5, 2021
· release notes
Zscaler Client Connector 3.17.6 adds dedicated proxy ports and machine tunnel IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. auth options
Adds option to enable and select dedicated proxy ports in the Administration settings Adds option to configure IdP authentication via a machine tunnel
2 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-02-02
Feb 2, 2021
· release notes
Adds ZPA reauthentication notification configuration in the Client Connector UI.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-02-01
Feb 1, 2021
· release notes
New SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Report and Policy features deployed to zscaler.net, zscalertwo.net, and zscloud.net on 2021-02-01.
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-01-29
Jan 29, 2021
· release notes
ZIA adds Sandbox Analysis for malware via the SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API across zscaler.net, zscalertwo.net, and zscloud.net.
Client Connector — Client Connector App Release Summary (2021) — 2021-01-28
Jan 28, 2021
· release notes
Zscaler Client Connector 3.0 adds macOS Smart Card auth, CLI Safari auth, DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. 1.2, loopback PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. serving, and Z-Tunnel 2.0 improvements.
Adds support for Smart Card authentication on macOS devices. Now supports DTLS 1.2 for the Z-Tunnel 2.0 data channel and enforces DTLS 1.2 when FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. is enabled. Includes support for segmented HTTP requests in Z-Tunnel 1.0 and Tunnel with Local Proxy (TWLP) modes. Adds storage of keychain data with administrator access. Zscaler Client Connector now uses cached app profile PAC when an intermittent PAC file download fails.
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2021) — 2021-01-27
Jan 27, 2021
· release notes
Admin Portal Health dashboard now labels disconnected ZPA Private Service Edges.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-01-22
Jan 22, 2021
· release notes
ZDX adds ZIA Public Service Edge hash to Cloud Path view and password expiration config for admins
Cloud Path section of the Users Dashboard now shows a 4-digit hash for the ZIA Public Service Edge in Hop View and Cloud Path View Configures Password Expiration for ZDX admins directly in the ZDX Admin Portal or the ZIA Admin Portal
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-01-22
Jan 22, 2021
· release notes
ZIA SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API adds GitHub tenant configuration, scan scheduling for repos, sandbox analysis, and reporting.
Adds SaaS Security API support for configuring GitHub as a new SaaS application tenant Adds scan schedules configuration for source code repositories via the SaaS Security API Policies Adds GitHub visibility in the SaaS Assets Summary Report Adds GitHub visibility in SaaS Security Insights and Insights Logs Enables Sandbox analysis for malware detection within SaaS Security API scans
5 details in Everything
Client Connector — Client Connector App Release Summary (2021) — 2021-01-20
Jan 20, 2021
· release notes
Client Connector adds support for large SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. assertions (>60K) on Android
Supports SAML assertions greater than 60K on Android.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-01-19
Jan 19, 2021
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security Posture Report and configurable policy count for SaaS risk analysis
Adds the SaaS Security Posture Report to display organizational security posture, threats, risk levels, and remediation activities for SaaS applications against recommended standards. Adds a configurable SaaS Security Posture Policy setting that controls the number of recommended security policies included in the SaaS Security Posture Report analysis.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2021) — 2021-01-15
Jan 15, 2021
· release notes
ZIA adds Citrix ShareFile and GitHub support in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API and Identity Proxy, plus Swiss AHV AHV Acropolis Hypervisor, Nutanix's built-in bare-metal hypervisor for running VMs on their hyper-converged infrastructure, giving cyber tools a tightly integrated compute and storage layer without a separate hypervisor license. DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. detection
Adds Citrix ShareFile to supported SaaS applications for tenant configuration, policy, and scan schedule management via the SaaS Security API. Adds Social Security Number (Switzerland) as a selectable Data Type in Exact Data Match (EDM) templates, backed by a new predefined DLP dictionary detecting AHV numbers. Enables configuring Zscaler Identity Proxy for GitHub and ShareFile cloud apps from the Administration > Identity Proxy Settings page of the ZIA Admin Portal.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2021) — 2021-01-08
Jan 8, 2021
· release notes
ZDX Web Probe updated Page Fetch Time metric to measure only the top-level page document, excluding embedded links.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-12-18
Dec 18, 2020
· release notes
ZDX adds Deep Tracing for process-level device insights and enhances User Details page with application filtering.
Adds Deep Tracing capability to collect process-level information every minute during a session Enhances the User Details page to allow flexible viewing and sorting of user information by application
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-12-16
Dec 16, 2020
· release notes
Zscaler ZIA adds custom root certificate management for Cloud Browser Isolation profiles
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-12-15
Dec 15, 2020
· release notes
ZPA adds SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. attributes/groups as criteria in access/timeout/client forwarding policies.
Adds SCIM Attributes and Groups for Policy setting when creating an identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. New session status codes related to user disabling by SCIM Health dashboard now identifies disabled App Connectors with a label below the App Connector Increases filter name limit to 100 for App Connector: Name and Service Edge: Name on diagnostic pages
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-12-14
Dec 14, 2020
· release notes
ZIA adds customizable end user notifications and PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file override for Cloud Browser Isolation profiles.
Adds customizable end user notification banners in Cloud Browser Isolation, allowing admins to set text, background color, welcome title, message, logo, or disable the banner entirely Adds Override PAC File option in Cloud Browser Isolation isolation profiles to return traffic to the originated Public Service Edge and avoid incorrect webpage translation
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-12-11
Dec 11, 2020
· release notes
ZIA adds PESEL DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary, increases custom DLP limit to 160, new SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. migration path, and Count All/Unique actions for DLP patterns
Adds Identity Card Number (Poland) as a predefined DLP/EDM data type for detecting PESEL numbers Increases maximum number of custom DLP dictionaries from 79 to 160 Enables migration from Directory Synchronization to SCIM Provisioning by disabling directory sync and enabling SCIM in the Authentication Profile page, where the Directory Type field is now named User Repository Type Adds Count All action for Patterns & Phrases DLP dictionaries to count every match toward the limit Adds Count Unique action for Patterns & Phrases DLP dictionaries to count each unique pattern or phrase only once
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The Directory Type field on the Authentication Profile page is renamed to User Repository Type
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-12-11
Dec 11, 2020
· release notes
ZDX Users Dashboard gains Web Probe error icons and Cloud Path tunnel flow visibility
Adds clickable error icons in the Web Probe Metrics section of the Users Dashboard to display error information for all graphs Shows traffic flow through configured tunnels in the Cloud Path section of the Users Dashboard
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-12-04
Dec 4, 2020
· release notes
ZIA adds PESEL DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary, CRM support in SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API, and SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. migration path.
Adds Identity Card Number (Poland) predefined DLP dictionary to detect PESEL numbers Increases maximum number of custom DLP dictionaries from 79 to 160 Adds SCIM Provisioning option to migrate users from directory synchronization Renames Directory Type field to User Repository Type on the Authentication Profile page Adds Count All and Count Unique actions for Patterns & Phrases type DLP dictionaries
+3 more
show less
Enables Salesforce tenant configuration in SaaS Security API Adds CRM application support for SaaS Security API policies and scan schedules Adds New Data Only option to SaaS Security API scan configuration to ignore historical data
8 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-12-04
Dec 4, 2020
· release notes
ZDX dashboards gain application filtering in Users view and time-range zooming in ZDX Score graphs.
Adds the ability to filter the Users Dashboard by one or more selected applications via the Applications filter drop-down, allowing users to view distribution and list data for specific apps.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-12-02
Dec 2, 2020
· release notes
Client Connector 3.1 for Windows introduces ZSATrayManager service and stricter certificate chain compliance.
Adds ZSATrayManager new service to the Client Connector architecture Enforces non-compliant posture when the intermediate CA or root CA is missing from the system certificate chain
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The ZSATrayManager service must be explicitly added to the Windows allowlist, or it will be blocked by security policies.
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-11-20
Nov 20, 2020
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report, Domain Fronting Hostname field to Web Insights, Salesforce tenant support, and New Data Only scan option
Adds SaaS Assets Report page showing current state of files and email messages. Adds Domain Fronting Hostname as a new field available in filters and columns for Web Insights logs. Adds Salesforce tenant configuration support in the SaaS Security API. Adds New Data Only option in SaaS Security API Scan Configuration to ignore historical data. Enables CRM application category viewing in SaaS Assets Summary Report, SaaS Security Insights, and Insights Logs.
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The SaaS Security Report has been renamed to the SaaS Assets Summary Report , so any links or references using the old name will no longer resolve.
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-11-19
Nov 19, 2020
· release notes
ZPA now supports multiple posture profile condition sets for access, timeout, and client forwarding policies (up to 10 per policy).
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-11-18
Nov 18, 2020
· release notes
ZIA adds verification gate for custom PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. files with explicit risk acceptance.
Add PAC File window now verifies PAC file syntax before saving, blocking saves with errors and requiring explicit I accept the risk acknowledgment to proceed.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-11-16
Nov 16, 2020
· release notes
Client Connector 3.0.2 adds periodic posture evaluation, system cert store checks, and proxy restoration on exit.
Zscaler Client Connector now evaluates postures on a periodic basis Zscaler Client Connector now supports posture checks for client certificates in the system certificate store Zscaler Client Connector now supports restoring the previous system proxy settings upon exiting based on the app profile settings PCAP PCAP A packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file size is now increased to 500 MB from 100 MB
4 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-11-13
Nov 13, 2020
· release notes
Client Connector 2.2.3 for macOS adds periodic posture evaluation and DNS domain filtering in Z-Tunnel 2.0 config.
Evaluates device postures on a periodic basis instead of only at connection time. Supports inclusion and exclusion of DNS domains as part of Z-Tunnel 2.0 configuration.
2 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-11-13
Nov 13, 2020
· release notes
Zscaler Client Connector Portal 3.17.5 adds DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. 1.2, Machine Tokens, Z-Tunnel 2.0 bypass, and enhanced audit log filtering.
Includes support for the DTLS 1.2 protocol to enable Datagram Transport Layer Security communications. Adds Machine Tokens to provide authentication capabilities for Windows devices via Zscaler Client Connector profile rules. Allows enabling or disabling automatic population of the username field in IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. login forms. Supports bypassing applications for Z-Tunnel 2.0 configuration in the app profile. Enables inclusion and exclusion of DNS domains in the app profile for Z-Tunnel 2.0 configuration.
+6 more
show less
Allows saving and restoring system proxy settings via the app profile. Supports forwarding user traffic to a dedicated proxy port through Zscaler Client Connector. Adds custom Time Range filters and search options (Client IP, Resource, Admin ID) for audit entries, with export capability. Extends audit log storage retention to up to 6 months. Supports adding ports in the Destination Exclusions field for the macOS app profile. Supports posture checks for detecting device ownership.
11 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-11-13
Nov 13, 2020
· release notes
ZIA adds PAC PAC A Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file verification enforcement and Domain Fronting Hostname field in Web Insights logs.
PAC File Verification now enforces pre-save validation with an I accept the risk bypass Web Insights on zscalerone.net and zscalerthree.net supports Domain Fronting Hostname in filters and columns
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-11-12
Nov 12, 2020
· release notes
ZPA adds TLS-encrypted log delivery for LSS and new Browser Access log fields
Adds tls encryption support for ZPA Log Streaming Service (LSS) between the App Connector and log receiver Adds Origin and CorsToken to the default Browser Access log template
2 details in Everything
Private Access (ZPA) — App Connector Release Summary (2020) — 2020-11-06
Nov 6, 2020
· release notes
App Connector 20.121.1 adds TLS encryption for LSS log streaming and UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. socket reuse.
Enables Zscaler Private Access (ZPA) Log Streaming Service to encrypt logs between the LSS App Connector and a log receiver using TLS encryption Allows the software to reuse open UDP sockets for initiating connections to application servers instead of opening a new UDP socket for an application connection
2 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-11-06
Nov 6, 2020
· release notes
Zscaler Client Connector 3.17.5 adds Machine Tokens, Z-Tunnel 2.0 profile controls, and enhanced audit logs.
Adds Machine Tokens authentication capability for Windows devices via Machine Provisioning keys. Adds support for DTLS 1.2 protocol in the Zscaler Client Connector. Adds device ownership detection posture checks in Device Posture Profiles. Enables inclusion and exclusion of DNS domains in the app profile for Z-Tunnel 2.0 configuration. Enables application bypass settings in the app profile for Z-Tunnel 2.0 configuration.
+7 more
show less
Allows enabling or disabling automatic population of the username field in IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. login forms. Supports saving and restoring system proxy settings via the app profile. Adds support for forwarding user traffic to a dedicated proxy port through Zscaler Client Connector. Adds ports to the Destination Exclusions field for the macOS app profile. Adds multiple custom Time Range filters and search options (Client IP, Resource, Admin ID) to Audit Logs. Enables exporting audit entries from the Audit Logs page. Extends audit log storage retention to up to 6 months.
12 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-11-06
Nov 6, 2020
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Assets Report, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for Malaysia/Indonesia, and expanded custom DLP phrase limits.
Adds Identity Card Number (Malaysia) and Tax Identification Number (Indonesia) as selectable Data Types in EDM templates Increases the maximum number of phrases allowed in a custom DLP dictionary from 120 to 256 Adds new file type categories (Database, Other Microsoft Files, Source Code) and expanded types for File Type Control and DLP policies Introduces the SaaS Assets Report showing current state of files and email messages
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The SaaS Security Report has been renamed to the SaaS Assets Summary Report
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-10-30
Oct 30, 2020
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries for Malaysian and Indonesian PII PII Personally Identifiable Information — data that can identify a specific individual, such as names, email addresses, or SSNs. Cyber tools flag or redact it to limit exposure and meet privacy regulations. , new file type categories, and higher custom dictionary limits
Adds Identity Card Number (Malaysia) as a predefined DLP dictionary and EDM data type. Adds Tax Identification Number (Indonesia) as a predefined DLP dictionary and EDM data type. Increases the maximum number of phrases for custom DLP dictionaries from 120 to 256. Adds Database , Other Microsoft Files , and Source Code as new file type categories in File Type Control and DLP policies.
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-10-27
Oct 27, 2020
· release notes
ZPA Browser Access now forwards CORS CORS A browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript. requests to App Connectors with configurable headers and adds Origin/CorsToken log fields.
Adds Access-Control-Allow-Origin header forwarding for authenticated CORS requests Redirects unauthenticated CORS requests to an authentication domain Adds Origin and CorsToken fields to Custom Log Templates
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-10-26
Oct 26, 2020
· release notes
ZPA allows Access Policies to target specific App Connectors via new Policy to Connector Group and Server Group associations.
Adds the Policy to Connector Group Association resource type to Control Center administrator roles and audit logs Adds the Policy to Server Group Association resource type to Control Center administrator roles and audit logs Adds error code BRK_MT_SETUP_FAIL_CONNECTOR_GROUPS_MISSING to User Activity logs when an App Connector is missing in a Server Group
3 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-10-23
Oct 23, 2020
· release notes
Zscaler Client Connector adds automatic ZPA reauthentication and device registration via ZPA IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. username.
Zscaler Client Connector now supports automatic reauthentication attempts for users with ZPA Zscaler Client Connector now allows you to register a device in the Zscaler Client Connector Portal with the ZPA authentication username
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-10-23
Oct 23, 2020
· release notes
Web Insights and dashboard widgets for Traffic Direction now support only the Bytes unit
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-10-23
Oct 23, 2020
· release notes
ZDX adds alerting capabilities and multi-application selector for Dashboard metrics
Adds ability to configure alerts based on application, device, or network performance thresholds, with delivery via email or webhook and viewing in the ZDX Admin Portal. Adds an application selector widget in the ZDX Dashboard for the ZDX Score and Page Fetch Time widgets, enabling comparison across multiple applications simultaneously.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-10-22
Oct 22, 2020
· release notes
Adds custom 15-minute interval filtering for time ranges on Application and Users Dashboards
Enables setting a Custom Range in 15-minute increments for the Time Range filter on the Application Dashboard. Enables setting a Custom Range in 15-minute increments for the Time Range filter on the Users Dashboard.
2 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-10-19
Oct 19, 2020
· release notes
Client Connector 1.7.1 for Android adds device ownership posture checks at installation
Client Connector — Client Connector App Release Summary (2020) — 2020-10-18
Oct 18, 2020
· release notes
Zscaler Client Connector iOS 1.8.1 adds no-user-input enrollment via authByTunnel config.
Improves the Zscaler Client Connector enrollment process with interactive UI.
1 detail in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-10-16
Oct 16, 2020
· release notes
ZDX adds configurable alerts for application, device, and network performance thresholds with email/webhook delivery
Adds the ability to configure alerts based on preset thresholds for application, device, and network performance events Enables alert delivery via email or webhook in addition to viewing triggered alerts in the ZDX Admin Portal
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-10-09
Oct 9, 2020
· release notes
ZPA Admin Portal adds a graphical view of configuration object connections for App Connectors, Segments, and Server Groups
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-10-09
Oct 9, 2020
· release notes
ZIA adds FQDN evaluation in Cloud Firewall policies, road warrior traffic filtering in QBR reports, and NAT-Traversal for multiple IPSec tunnels.
Adds FQDN evaluation support to both Standard and Advanced Cloud Firewall policies Enables inclusion or exclusion of remote (road warrior) user traffic in the Quarterly Business Review Report Sets a rate limit of 20 requests per hour for exporting Web, Mobile, Firewall, DNS, and Tunnel Insights Logs to CSV Adds NAT-Traversal support for multiple IPSec tunnels to Zscaler Cloud, allowing multiple tunnels over a single public IPv4 address
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-10-09
Oct 9, 2020
· release notes
ZDX adds a Remote Assistance feature allowing Zscaler Support to securely access the Admin Portal for troubleshooting.
Enables Remote Assistance capability in the ZDX Admin Portal for secure, limited-time remote login by Zscaler Support.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-10-08
Oct 8, 2020
· release notes
ZPA adds Private Service Edge capability for hosting ZPA functionality in customer environments
Adds Private Service Edge capability to host ZPA Service Edge functionality in the organization's environment as a single-tenant instance managed by Zscaler. Requires Zscaler Client Connector version 2.1.2 minimum for Private Service Edge access. Introduces Service Edge Group page and Service Edge Provisioning Keys page to view and manage Private Service Edge groups and keys. Adds Service Edge Status Diagnostics to monitor and track all ZPA Public Service Edges and ZPA Private Service Edges.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-10-02
Oct 2, 2020
· release notes
ZIA adds FQDN evaluation to Cloud Firewall policies and road warrior traffic controls for QBR reports.
Adds FQDN Evaluation support for both Standard and Advanced Cloud Firewall policies on zscalerone.net, zscalerthree.net, and zscloud.net Adds the ability to include or exclude remote user (road warrior) traffic in the Quarterly Business Review (QBR) Report on zscalerone.net, zscalerthree.net, and zscloud.net Extends AI/ML-based content categorization support to additional URL categories including Alcohol/Tobacco, Anonymizer, Art/Culture, Blogs, Classifieds, Continuing Education/College, Dining/Restaurant, FileHost, Finance, Government, Job/Employment Search, K-12, Online Auctions, Online Shopping, Radio Stations, Real Estate, Social Networking, Special Interests/Social Organizations, Travel, and Vehicles on zscloud.net Adds new cloud app definitions for WeChat Work, Grammarly, Realtor, TradingView, Chocolatey, New Relic, Glia, StreamRail, WalkMe, ZenDesk, AdRoll, Celtra, Connatrix, Conviva, Criteo, Dianomi, FullStory, Medallia, Outbrain, Permutive, RevJet, SundaySky, Taboola, Yotpo, iHeartRadio, Bugsnag, and Split to Cloud App Control categories on zscalerone.net and zscalerthree.net Enforces a rate limit of 20 requests per hour for exporting Web, Mobile, Firewall, DNS, and Tunnel Insights Logs to CSV files on zscalerone.net and zscalerthree.net
5 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-10-01
Oct 1, 2020
· release notes
Zscaler Client Connector 2.2.1 for macOS adds ZDX integration, Smart Card auth, and cloud selection.
Adds support for the Zscaler Digital Experience (ZDX) service Enables Smart Card authentication on macOS devices Allows selection of the target Zscaler cloud
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Zscaler Client Connector supports only macOS 10.14 or later versions from this release onwards.
Client Connector — Client Connector App Release Summary (2020) — 2020-09-30
Sep 30, 2020
· release notes
Zscaler Client Connector 3.0 for Windows adds DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. 1.2, TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. DNS over ZPA, and configurable cloud selection.
Adds support for the DTLS 1.2 protocol Enables DNS traffic for ZPA domains over TCP Allows selection of the target Zscaler cloud Supports wildcard definitions in ZPA application segments (e.g., *) Includes end user email address with the Report an Issue option
5 details in Everything
└──▷ BREAKING ON UPGRADE
! Zscaler Client Connector no longer performs DNS resolution for mobilesupport.zscaler.com when support access is disabled
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-09-30
Sep 30, 2020
· release notes
Adds Command Line View of the Cloud Path probe to the User Overview dashboard
Enables viewing Hop Direction, Region, Geolocation, Packet Loss (%), Packets Failed, and Latency metrics for Cloud Path probes
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-25
Sep 25, 2020
· release notes
ZIA adds tenant profiles for granular cloud app restrictions and rule expiration controls to policy rules.
Adds Administration > Tenant Profiles page to create and manage tenant profiles for cloud applications Extends tenancy restriction support to YouTube, Slack, and Dropbox applications Moves Google Apps and Microsoft Login Services tenancy restrictions from Policy > URL & Cloud App Control > Advanced Policy Settings to the new Administration > Tenant Profiles page Adds Enable Rule Expiration control in URL Filtering and Cloud App Control policy rules to set start/end dates and time zones for rule validity Exposes rule expiration functionality via the cloud service API
+1 more
show less
Renames the Top Level Domains column to No. of Top Level Domains on the TLD TLD The rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. Categories page
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The configuration location for Google Apps and Microsoft Login Services tenancy restrictions has changed from Policy > URL & Cloud App Control > Advanced Policy Settings to Administration > Tenant Profiles; existing rules are automatically migrated.
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-09-25
Sep 25, 2020
· release notes
ZDX adds remote assistance capability allowing Zscaler Support to log in for troubleshooting.
Users can now allow Zscaler Support to securely and remotely log in to the ZDX Admin Portal for a limited period of time.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-22
Sep 22, 2020
· release notes
ZIA adds Administration > Tenant Profiles page and extends tenancy restriction to YouTube, Slack, and Dropbox
Introduces the Administration > Tenant Profiles page for creating tenant profiles associated with cloud app control rules. Extends tenancy restriction support to YouTube, Slack, and Dropbox applications. Adds granular controls for YouTube via Channel IDs, Category selections (e.g., Education , Gaming ), and School IDs. Enables Slack tenancy restriction by specifying workspace IDs (team ID) and allowed workspace IDs (e.g., T2DQ3J9AA ). Allows Dropbox access control by providing allowed Dropbox team IDs (e.g., 4875936 ) for work or personal accounts.
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-09-18
Sep 18, 2020
· release notes
ZPA Admin Portal now allows selecting Zscaler Client Connector tenant and cloud for cross-cloud integration
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-18
Sep 18, 2020
· release notes
ZIA adds rule expiration for URL and app policies, ML prescanning in Sandbox, and expanded AI URL categorization
Adds Enable Rule Expiration control to URL Filtering and Cloud App Control policy rules to set start/end dates and time zone. Exposes rule expiration settings via the cloud service API for automated policy management. Adds Sandbox Machine Learning prescanning to predict malware likelihood for unknown files during quarantine before sandbox verdicts.
3 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-09-18
Sep 18, 2020
· release notes
Adds configurable Packet Interval and Timeout for Cloud Path Probes, plus direct SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. access to CC Portal from ZDX Admin.
Packet Interval and Packet Timeout are now available as selectable configuration options for Cloud Path ProbesAdds direct Single Sign-On (SSO) access to the Zscaler Client Connector Portal from the Zscaler Digital Experience (ZDX) Admin Portal
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-11
Sep 11, 2020
· release notes
ZIA adds Thai ID DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary, ML sandbox prescanning, expanded AI URL categorization, and new cloud apps
Adds Identity Card Number (Thailand) as a selectable Data Type in EDM templates for DLP Enables machine learning prescanning in the Sandbox policy to predict malware likelihood for unknown files Extends AI/ML-based content categorization support to 19 additional URL categories Adds Amazon Chime, TagMyDoc, ServiceNow, Sohu TV, QQMail, Tencent Cloud, and OVHcloud to predefined Cloud App Categories
4 details in Everything
Digital Experience Monitoring (ZDX) — Release Upgrade Summary (2020) — 2020-09-11
Sep 11, 2020
· release notes
Adds direct access to the Zscaler Client Connector Portal from the ZDX Admin Portal.
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-09-10
Sep 10, 2020
· release notes
ZPA Browser Access now supports forwarding unauthenticated HTTP OPTIONS preflight requests via new Application Segment setting.
Adds the ability to forward unauthenticated HTTP OPTIONS preflight requests from the browser to the application in Browser Access Consolidates Health Reporting and Health Check into a single setting within the Application Segment workflow
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-09-04
Sep 4, 2020
· release notes
ZIA adds Thai ID DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionary, extends AI/ML URL categorization, updates cloud app categories, introduces Sandbox prescanning and Source IP Anchoring.
Adds Identity Card Number (Thailand) to predefined DLP dictionaries for Exact Data Match templates Extends AI/ML-based content categorization to 21 additional URL categories including Finance, Social Networking, and Shopping Adds cloud apps Amazon Chime, TagMyDoc, ServiceNow, Sohu TV, QQMail, Tencent Cloud, and OVHcloud to predefined Cloud App Categories Enables machine learning prescanning to detect malware likelihood for files in Sandbox quarantine before verdict
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-09-03
Sep 3, 2020
· release notes
Updates to the ZPA Admin Portal enable wildcard-based application definitions.
Allows defining applications by only a wildcard (e.g., *) within Application Segments.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-08-31
Aug 31, 2020
· release notes
Client Connector 1.8 (iOS) and 1.7 (Android) add FIPS FIPS A set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. default and cloud selection
New installations of Zscaler Client Connector now enable FIPS by default on iOS and Android. Users can now select the specific Zscaler cloud to connect from the Client Connector app UI.
2 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-08-28
Aug 28, 2020
· release notes
Zscaler Client Connector Portal 3.17.4 adds SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for ZDX and per-user app profile assignment
Adds single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support for the Zscaler Digital Experience (ZDX) service. Adds support to assign app profiles to individual users.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-08-28
Aug 28, 2020
· release notes
ZIA adds firewall threat logging for IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. detections and Source IP Anchoring support.
Adds Firewall Threat Logging with IPS to log detected threats in Firewall Insights > Logs, filterable by IPS Control Policy categories Adds Support for Source IP Anchoring via granular policies in the ZIA Admin Portal to steer traffic egress through specific ZPA App Connectors
2 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-08-21
Aug 21, 2020
· release notes
Adds optional ZDX service module with RPC RPC Remote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. validation and detailed traceroute data
Adds support for the Zscaler Digital Experience (ZDX) service as an optional module within Client Connector 2.2.1 Adds additional validation for remote procedure calls (RPC) in the Client Connector app Enhances the ZDX module to provide detailed information for all traceroute hops
3 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-08-21
Aug 21, 2020
· release notes
Zscaler Client Connector 3.17.4 adds SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for ZDX, per-user app profile assignment, and expanded bypass field limit.
Adds single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. support for the Zscaler Digital Experience (ZDX) service within Zscaler Client Connector Portal 3.17.4 Adds support to assign app profiles to individual users Increases the Hostname Or IP Address Bypass For VPN Gateway field limit to 12 k characters in Zscaler Client Connector profiles Reports when users with an iOS device disable On Demand for the VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. setting
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-08-21
Aug 21, 2020
· release notes
ZIA adds Firewall Threat Logging with IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. to Firewall Insights logs
Private Access (ZPA) — App Connector Release Summary (2020) — 2020-08-19
Aug 19, 2020
· release notes
App Connector 20.51.3 adds uptime display, CPU CPU The main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. /memory/disk stats logging, and memory calculation improvements.
The App Connector logs now show the App Connector uptime as a readable string with the format: X days Y hours Z seconds . The App Connector will log the CPU, memory, and disk utility stats in the App Connector status logs. The amount of available memory for App Connectors is now calculated as the sum of free memory and any cached memory for the system.
3 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-08-17
Aug 17, 2020
· release notes
Client Connector 1.7 for iOS adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. NAT64 support and re-enables On Demand VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. profile on launch.
Zscaler Client Connector now supports IPv6 NAT64 by default Client Connector re-enables On Demand when the user launches the app in relation to a VPN profile
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-08-14
Aug 14, 2020
· release notes
ZIA adds DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. Match Only engine filtering, Boolean operators for custom dictionaries, Aadhaar support, and Microsoft 365 Identity Proxy configuration.
Adds Administration > Identity Proxy Settings page in ZIA Admin Portal to configure Identity Proxy for multiple Microsoft 365 cloud app instances Adds Zscaler Incident Receiver tool that receives DLP violations via ICAP and sends policy-violating content with JSON metadata to on-premises systems Adds Match Only option in DLP rule configuration to trigger rules only when transactions match specified DLP engines, ignoring matches from other rules Adds All (AND) and Any (OR) Boolean operators for Patterns & Phrases type custom DLP dictionaries, with Any as the default Adds Aadhaar Card Number (India) as a new predefined DLP dictionary and EDM Data Type for detecting Indian UID numbers
5 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-08-11
Aug 11, 2020
· release notes
ZPA adds new session error codes for file and port exhaustion to App Connectors.
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-08-07
Aug 7, 2020
· release notes
ZIA adds Match Only DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. rule logic, Boolean operators for custom dictionaries, Aadhaar EDM type, M365 Identity Proxy, and Incident Receiver.
Adds the Match Only option in DLP policy rules to restrict triggers to specified DLP engines only Enables Boolean operators All (AND) and Any (OR) for Patterns & Phrases type custom DLP dictionaries Adds Aadhaar Card Number (India) as a new predefined DLP dictionary Adds Aadhaar Card Number (India) as a selectable Data Type in EDM templates Adds configuration of Identity Proxy for Microsoft 365 via Administration > Identity Proxy Settings page and support for multiple instances
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-07-31
Jul 31, 2020
· release notes
ZIA adds NAT-T for multiple IPSec tunnels and admin conversion options
Adds NAT-Traversal support to simplify deploying multiple IPSec tunnels over a single public IPv4 address. Adds the ability to convert deleted admins into regular users rather than deleting them from the organization. Adds search filters for URL, Keyword, and URL Category Name on the URL Categories page.
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-07-27
Jul 27, 2020
· release notes
Adds Source IP Anchoring to steer ZIA traffic back to on-prem networks via App Connectors
Enables configuration of application segments and access policies for Source IP Anchoring
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-07-24
Jul 24, 2020
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API support for Gmail and Exchange, Source IP Anchoring, and admin conversion on delete.
Enables configuring tenants for Gmail and Microsoft Exchange via the SaaS Security API, extending support beyond file-sharing apps like Dropbox and Google Drive. Allows optional addition of external trusted domains and users for email application tenants (Gmail, Exchange) in the SaaS Security API. Permits configuration of SaaS Security API policies and scan schedules specifically for email applications, whereas previously this was limited to file sharing. Introduces Data Loss Prevention (DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. ) policy exceptions configurable for both file sharing and email application tenants via the SaaS Security API. Adds Application Category filter section (File or Email) to SaaS Security Insights and Insights Logs.
+2 more
show less
Enables selecting whether to retain deleted admins as users or delete them entirely from the organization during the deletion process. Introduces URL, Keyword, and URL Category Name filters for the URL Categories page search in the admin portal.
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-07-20
Jul 20, 2020
· release notes
ZPA Admin Portal adds Audit Log streaming via LSS and pagination to Connected Users widget
The Log Streaming Service (LSS) now supports streaming of Audit Logs from your organization’s ZPA tenant to your log receiver. Pagination was added to the Current Connected Users widget on the User Dashboard to improve load time for large user lists.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The relationship graph in the Connector section of the Health Dashboard has been deprecated.
Client Connector — Client Connector App Release Summary (2020) — 2020-07-17
Jul 17, 2020
· release notes
Zscaler Client Connector 1.5.5 for Android improves app logs and fixes connectivity/incompatibility issues.
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-07-17
Jul 17, 2020
· release notes
ZIA adds 1000-app Cloud Application Trend widget, searchable Name column, flexible DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. regex base tokens, and NAT-T for multiple IPSec tunnels
Cloud Application Trend widget in the Cloud Applications dashboard now supports listing 1,000 applications (up from previous limit)Custom DLP patterns support special characters (e.g., %, [@#]) and shorthand characters (\b, \s) as base tokens Custom DLP dictionaries no longer implicitly prepend word boundary (\b); admins must explicitly include it in existing patterns to maintain functionality NAT-Traversal (NAT-T) enabled for multiple IPSec tunnels, allowing branches/data centers to use a single public IPv4 address for >1Gig throughput
4 details in Everything
└──▷ BREAKING ON UPGRADE
! Implicit word boundary (\b) at the beginning of custom DLP patterns is removed; existing patterns relying on this implicit behavior will no longer match as before and must be updated to explicitly include \b
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-07-14
Jul 14, 2020
· release notes
ZPA raises app segment limit to 2000, adds DNS CNAME CNAME A DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. toggle and subset PSE routing.
Raises the number of applications per application segment from 100 to 2000. Adds an option in the Admin Portal to prevent App Connectors from sending CNAME DNS records to Zscaler Client Connector.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-07-10
Jul 10, 2020
· release notes
Cloud Application Trend Widget supports 1,000 apps and searchable Name column
Adds support for displaying 1,000 applications in the Cloud Application Trend widget on the Cloud Applications dashboard. Enables searching within the Name column of the Cloud Application Trend widget.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-07-03
Jul 3, 2020
· release notes
ZIA adds Azure Virtual WAN integration, Carbon Black partner integration, new Insights data types, and Top Threat Names report.
Adds Azure Virtual WAN (VWAN) Partner Integration with one-click configuration for outbound IPSec tunnels to Zscaler data centers Adds Carbon Black Partner Integration allowing endpoint containment requests from the ZIA Admin Portal to Carbon Black for advanced persistent threat remediation Adds new data types (Client External IP , Client IP , File Name , File Type , Server IP , Threat Name ) to Web Insights; (Server IP ) to DNS Insights; and (Threat Name , Client Server IP , Server Destination IP ) to Firewall Insights Adds New Interactive Report: Top Threat Names showing top threat names for Web and Firewall services Simplifies support for multiple IPSec tunnels to Zscaler Cloud with NAT-Traversal, allowing multiple tunnels over a single public IPv4 address
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-06-26
Jun 26, 2020
· release notes
ZIA adds UCaaS one-click configuration for Zoom/LogMeIn/RingCentral and new insights data types.
Enables direct-to-cloud access for UCaaS applications (Zoom, LogMeIn, RingCentral) via UCaaS One Click Configuration Adds Client External IP , Client IP , File Name , File Type , Server IP , and Threat Name as selectable data types in Web Insights Adds Server IP as a selectable data type in DNS Insights Adds Threat Name , Client Server IP , and Server Destination IP as selectable data types in Firewall Insights Introduces the Top Threat Names interactive report widget for Web and Firewall insights
5 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-06-22
Jun 22, 2020
· release notes
Client Connector 2.1.2.44 for macOS adds install option to prevent auto-launch and improves UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. /Z-Tunnel performance
Adds an installation option that prevents Zscaler Client Connector from automatically launching after installation. Improves UDP application performance for the ZPA service. Improves upload and download speeds for Z-Tunnel 2.0 in different bandwidth networks for both TLS and DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. .
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-06-19
Jun 19, 2020
· release notes
ZIA adds Third-Party Proxy Chaining support to forward traffic via forwarding policies.
Client Connector — Client Connector App Release Summary (2020) — 2020-06-17
Jun 17, 2020
· release notes
Zscaler Client Connector for Android 1.5.4 adds username validation notifications and service error alerts with UI enhancements.
Adds username validation with a notification displayed for incorrect usernames Enables notifications for ZPA service authentication errors Includes Zscaler Client Connector UI redesigns and enhancements
3 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-06-17
Jun 17, 2020
· release notes
ZPA Admin Portal adds Application Segment Details view and search during segment editing
Adds a link in the Application Segment table (for segments with >3 apps) to open a read-only Application Segment Details window with search for apps, ports, certificates Enables search within the Application Segment edit window and adds multi-tab interface for managing app definitions and reviewing changes before saving
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-06-12
Jun 12, 2020
· release notes
ZIA adds support for third-party proxy chaining and simplified multiple IPSec tunnels via NAT-T on zscalerthree.net.
Adds support for Third-Party Proxy Chaining using forwarding policies to define traffic forwarded to a third-party proxy service Enables NAT-Traversal (NAT-T) for deploying multiple IPSec tunnels using a single public IPv4 address instead of unique addresses per tunnel
2 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-06-11
Jun 11, 2020
· release notes
Client Connector 1.6.2 for iOS adds IPv6 IPv6 The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support via NAT64/DNS64 DNS64 A DNS server mechanism that synthesizes AAAA (IPv6) records from A (IPv4) records, letting IPv6-only clients reach IPv4-only hosts without dual-stack infrastructure. Cyber tools use it to handle mixed-protocol environments transparently. .
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-06-05
Jun 5, 2020
· release notes
ZIA adds support for third-party proxy chaining via forwarding policies.
Private Access (ZPA) — App Connector Release Summary (2020) — 2020-06-01
Jun 1, 2020
· release notes
App Connector 20.20.3 adds private.zscaler.com deployment, Private Service Edge support, and OVA OVA An Open Virtualization Appliance file — a single portable package containing a virtual machine disk image and its configuration metadata, standardized by the DMTF, letting cyber tools ship as ready-to-run VM bundles. /RPM package updates for June 2020.
Enables Public Service Edges to redirect App Connector control connections to the geographically closest edge based on load and App Connector geolocation. Adds software updates to support new ZPA Private Service Edge functionality. Introduces new OVA and RPM packages for version 2020.06.
3 details in Everything
└──▷ BREAKING ON UPGRADE
! Starting with OVA version 2020.06, rsyslogd is disabled for App Connectors.
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-05-29
May 29, 2020
· release notes
ZIA adds a Suspicious Content filter to Web Insights Logs
Allows filtering Web Insights log entries to show only those containing suspicious content.
1 detail in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-05-08
May 8, 2020
· release notes
ZCC 3.17.2 defaults new profiles to no groups and adds multi-IDP IDP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support for ZIA
Adds support for using multiple identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. with the ZIA service
1 detail in Everything
└──▷ BREAKING ON UPGRADE
! The default group assignment for new or modified Zscaler Client Connector profiles changed from all groups to no groups
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-05-01
May 1, 2020
· release notes
ZIA adds support for deploying Virtual ZENs and Virtual Service Edges on Microsoft Azure.
Client Connector — Release Upgrade Summary (2020) — 2020-04-24
Apr 24, 2020
· release notes
Zscaler Client Connector Portal 3.17.2 now supports multiple identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. and changes profile rule group assignment defaults.
Adds support for using multiple identity providers with the ZIA service. Changes default group assignment for new profile rules to no groups instead of all groups.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! New Zscaler Client Connector profiles policy rules are assigned to no groups by default, whereas they previously assigned to all groups by default.
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-24
Apr 24, 2020
· release notes
ZIA introduces SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API for inspecting sanctioned SaaS data at rest via DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and Malware Detection policies.
Adds SaaS Application Tenants page to integrate sanctioned SaaS applications with the Zscaler service Adds ability to configure SaaS Security API Policies for Data Loss Prevention (DLP) and Malware Detection on data at rest Adds Scan Configuration to schedule inspections of SaaS tenant data using DLP and Malware Detection policies Adds SaaS Security Report page summarizing discovery and remediation activities for SaaS security Adds SaaS Security Insights and Insights Logs pages for analyzing API discovery results
+2 more
show less
Supports adding NSS Feeds specifically for SaaS Security Logs Extends NSS Feed Output Format to include fields for SaaS Security Logs
7 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-04-17
Apr 17, 2020
· release notes
Zscaler Client Connector Portal 3.17.2 adds multi-idP support for ZIA and changes default group assignment for profile rules.
Assigns new Zscaler Client Connector profiles policy rules to no groups by default when creating a new rule or deleting a group
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-17
Apr 17, 2020
· release notes
ZIA adds identity-based block override, multi-IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. , DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. logic enhancements, and remote browser isolation preview.
Adds Identity-based Block Override option under Policy > URL & Cloud App Control > Advanced Policy Settings to allow users with valid credentials to bypass blocks Enables configuration of multiple identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. for SAML single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via the Identity Providers settings Allows specifying match counts and combining DLP dictionaries with Boolean operators when configuring DLP engines Adds five new predefined DLP dictionaries (China, Taiwan, France, Spain, Korea ID numbers) and corresponding EDM Data Types Exposes new Location Management API endpoints: POST /locations/bulkdelete, PUT /locations/{locationsId}, DELETE /locations/{locationId}, and GET /locations/{locationId}/sublocations
+3 more
show less
Exposes new Admin & Role Management API resources: GET /adminRoles/lite, GET /adminUsers, POST /adminUsers, PUT /adminUsers/{userId}, and DELETE /adminUsers/{userId} Enables creation of dynamic Location Groups that automatically update based on location attributes Adds Zscaler Proxy Traffic as a new predefined firewall filtering rule for HTTP Tunnel connections
8 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-04-10
Apr 10, 2020
· release notes
Adds an App Connector dashboard in the ZPA Admin Portal for monitoring health and diagnostics
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-10
Apr 10, 2020
· release notes
ZIA adds SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API for inspecting sanctioned app tenants and new third-party proxy chaining support
Adds SaaS Application Tenants page to integrate and manage sanctioned SaaS applications via the SaaS Security API. Introduces Data Loss Prevention policy type in SaaS Security API Policies for data-at-rest protection. Introduces Malware Detection policy type in SaaS Security API Policies with configurable exceptions for threats to data at rest. Adds Scan Configuration settings to schedule DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and Malware detection scans on SaaS tenant data. Releases SaaS Security Report page summarizing discovery and remediation activities for SaaS content.
+4 more
show less
Deploys SaaS Security Insights and Insights Logs pages for detailed analysis of API-based findings. Enables adding NSS Feeds specifically for SaaS Security Logs to external log collectors. Extends NSS Feed Output Format to include specific SaaS Security log fields in the output schema. Adds support for Third-Party Proxy Chaining , allowing ZIA to act as a downstream proxy using existing forwarding policies.
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-04-03
Apr 3, 2020
· release notes
ZIA adds Remote Browser Isolation, Multi-IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. , Identity-based Block Override, and new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries/categories.
Adds Zscaler Proxy Traffic as a new predefined firewall filtering rule for HTTP tunnel connections with independent evaluation Adds Enable AI/ML-based Content Categorization option in Advanced Policy Settings to replace the previous dynamic categorization toggle Adds GET /locations/{locationId}/sublocations, POST /locations/bulkdelete, PUT /adminUsers/{userId}, and DELETE /adminUsers/{userId} endpoints to the Cloud Service API Adds Identity Card Number (China), National Identification Card Number (Taiwan), National Identification Number (France), National Identification Number (Spain), and Resident Registration Number (Korea) as new predefined DLP dictionaries Allows specifying match count per dictionary in DLP engines and combining dictionaries with Boolean operators to create logical expressions
+4 more
show less
Adds support for multiple identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. when configuring SAML single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for users Adds Enable Identity-based Block Override option under Policy > URL & Cloud App Control > Advanced Policy Settings Adds DNS Over HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. Services, End-to-End encrypted Content, Malicious TLDs, Marijuana, Online Trading/Brokerage/Insurance, Operating System and Software Updates, and Web Conferencing as new predefined URL categories Allows creation of dynamic location groups that automatically update based on matching location attributes
9 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-03-27
Mar 27, 2020
· release notes
ZIA release adds Limited Availability for Remote Browser Isolation on March 27, 2020.
Client Connector — Client Connector App Release Summary (2020) — 2020-03-26
Mar 26, 2020
· release notes
Client Connector 2.1.2 adds ZPA Private Service Edges support, device posture integrations, and unencrypted log export with crash dumps.
Adds support for ZPA Private Service Edges in Zscaler Client Connector profiles Adds Process Check , Carbon Black , Crowdstrike , and SentinelOne options to device posture profiles Enables tunneling internal traffic through Zscaler via new forwarding profile configuration Adds automatic MTU lowering based on forwarding profile configuration to prevent IP fragmentation
4 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-03-24
Mar 24, 2020
· release notes
Zscaler Client Connector Portal 3.17.2 updates default profile rule grouping and adds multiple identity provider identity provider A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. support.
Adds support for using multiple identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. with the ZIA service Changes default group assignment behavior for new Zscaler Client Connector profile rules or when deleting groups
2 details in Everything
└──▷ BREAKING ON UPGRADE
! New or modified Zscaler Client Connector profiles now assign rules to no groups by default instead of all groups when a rule is created or a group is deleted
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-03-20
Mar 20, 2020
· release notes
ZIA adds Remote Browser Isolation, Identity-based Block Override, FQDN NSS feeds, and multiple SAML IdP SAML IdP A SAML Identity Provider is a service that authenticates users and issues signed XML assertions to relying applications, letting a single login session span many services without re-entering credentials. support.
Adds Enable AI/ML-based Content Categorization option in Advanced Policy Settings to analyze uncategorized website content Supports manual or dynamic Location Groups for automated location assignment in policy targets Allows configuring Multiple Identity Providers for SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. configuration Integrates CrowdStrike Falcon API to provide endpoint detection and response endpoint detection and response Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. visibility for Sandbox detected malware Adds Enable Identity-based Block Override option under Policy > URL & Cloud App Control > Advanced Policy Settings tab to allow users with SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. credentials temporary access to blocked pages
+8 more
show less
Supports FQDN as destination in NSS feeds for TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. connections, enabling DNS-based failover Adds new predefined DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries: Identity Card Number (China), National Identification Card Number (Taiwan), National Identification Number (France), National Identification Number (Spain), and Resident Registration Number (Korea) Extends EDM template data types to include new national identification numbers from China, Taiwan, France, Spain, and Korea Adds multiple selection with exclusion capability and new string match operators (Does Not Contain, Does Not Start With, Does Not End With, Is Null, Is Not Null) for Insights Logs filters Supports match count configuration when adding DLP dictionaries to a DLP engine Allows combining DLP dictionaries with Boolean operators in DLP engines Adds Zscaler Proxy Traffic predefined firewall filtering rule for HTTP tunnel connections with independent evaluation Adds REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints /adminRoles/lite, /adminUsers, /locations/{locationId}/sublocations and updates Location Management resources
13 details in Everything
Private Access (ZPA) — App Connector Release Summary (2020) — 2020-03-19
Mar 19, 2020
· release notes
App Connector 19.102.3 improves UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. socket retention efficiency with configurable timeouts.
Reduces UDP socket consumption duration for ports 88, 123, 161, and 389 to release after 2 seconds instead of holding them indefinitely or for longer durations.
1 detail in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-03-17
Mar 17, 2020
· release notes
Client Connector 1.5.3 adds Knox SDK 3.4.1 support for Samsung Android 10 devices.
Adds Knox SDK 3.4.1 (Knox API level 30) support for Samsung devices running Android 10 Adds integration with Firebase Crashlytics 17.0 and Firebase Analytics 17.2.2
2 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-03-13
Mar 13, 2020
· release notes
Zscaler Client Connector 3.17.1 adds visual accessibility outline, internal traffic tunneling on Windows 10, Z-Tunnel 2.0 MTU config, multi-trusted networks for ZIA-only, por
Enables visual_accessibility feature to display an outline around actively selected controls for accessibility. Adds Windows 10 option to tunnel internal traffic (e.g., app updates) through Zscaler instead of direct send. Sets multicast traffic as a default destination exclusion for Z-Tunnel 2.0. Permits configuration of multiple trusted networks when licensed for ZIA only. Enables configuration of minimum Zscaler Client Connector version number display in the Portal for features requiring specific versions.
+1 more
show less
Supports using internal processes and endpoint security services (Carbon Black, CrowdStrike, SentinelOne) as device posture profile criteria.
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-03-13
Mar 13, 2020
· release notes
ZIA adds identity-based block override, multi-selection with exclusion in reports, and new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. dictionaries.
Adds Enable Identity-based Block Override option under Policy > URL & Cloud App Control > Advanced Policy Settings to allow authorized users to provide temporary access to blocked pages using SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. credentials Adds Multi-Selection with Exclusion Capability in Insights Logs, Interactive Reports, and Dashboard filters, supporting additional string match operators (Does Not Contain, Does Not Start With, Does Not End With, Is Null, Is Not Null) Adds five new predefined DLP dictionaries for international identity numbers: Identity Card Number (China), National Identification Card Number (Taiwan), National Identification Number (France), National Identification Number (Spain), and Resident Registration Number (Korea) Adds support for setting match counts per dictionary in DLP engines and combining dictionaries with Boolean operators to create logical expressions Adds multiple new REST API REST API A web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. endpoints for location management (POST /locations, PUT /locations/{locationsId}, DELETE /locations/{locationId}, GET /locations/{locationId}/sublocations) and admin role/user management (GET /adminRoles/lite, GET /adminUsers, POST /adminUsers, PUT /adminUsers/{userId}, DELETE /adminUsers/{userId})
+5 more
show less
Adds new predefined URL categories: DNS Over HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. Services, End-to-End encrypted Content, Malicious TLDs, Marijuana, Online Trading/Brokerage/Insurance, Operating System and Software Updates, and Web Conferencing Adds AI/ML-based content categorization for uncategorized websites under super categories: Games, Health, Religion, Shopping and Auctions, and Sports (renabling the setting Enable AI/ML-based Content Categorization in Advanced Policy Settings) Adds CrowdStrike partner integration to provide endpoint detection and response endpoint detection and response Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. visibility for Sandbox detected malware via the CrowdStrike Falcon API Adds dynamic location groups that automatically update to include matching locations or sub-locations based on selected attributes Adds support for multiple identity providers identity providers A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. when configuring SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. single sign-on single sign-on Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. for users
10 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-03-06
Mar 6, 2020
· release notes
Client Connector 3.17.1 adds visual accessibility outlines, Z-Tunnel 2.0 MTU and multicast exclusions, and internal service posture checks.
Adds visual outline around actively selected controls for accessibility Allows tunneling internal traffic (e.g., app updates) through Zscaler on Windows 10 Includes multicast traffic as a default destination exclusion for Z-Tunnel 2.0 Enables configuring the MTU for Z-Tunnel 2.0 connections to prevent fragmentation Supports multiple trusted networks for ZIA-only licensed users
+2 more
show less
Allows setting minimum Zscaler Client Connector version number in the Portal Supports internal processes and endpoint security services (Carbon Black, CrowdStrike, SentinelOne) as device posture profile criteria
7 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-02-28
Feb 28, 2020
· release notes
ZIA adds Identity-based Block Override, AI/ML content categorization, dynamic location groups, multiple SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. IdPs, and CrowdStrike integration.
Enable Identity-based Block Override option allows authorized users to provide temporary access to blocked pages using company login credentialsEnable AI/ML-based Content Categorization config enables the Dynamic Content Categorization service to analyze uncategorized website contentNew GET /locations/{locationId}/sublocations API resource retrieves sub-location information based on a parent location's ID New Admin & Role Management API resources available: GET /adminRoles/lite, GET /adminUsers, POST /adminUsers, PUT /adminUsers/{userId}, and DELETE /adminUsers/{userId} /locations and /locations/bulkdelete POST endpoints updated for location management, alongside PUT /locations/{locationsId} and DELETE /locations/{locationId}
+1 more
show less
CrowdStrike Partner Integration leverages CrowdStrike APIs to provide endpoint detection and response endpoint detection and response Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. visibility for Sandbox detected malware
6 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-02-21
Feb 21, 2020
· release notes
Zscaler Client Connector Portal 3.17.1 adds visual accessibility outlines, Z-Tunnel 2.0 internal traffic tunneling and MTU config, multi-trusted networks for ZIA-only, postur
Adds a visual accessibility feature that displays an outline around actively selected controls in the Zscaler Client Connector UI Enables tunneling internal traffic through Zscaler on Windows 10 devices instead of sending it directly Adds multicast traffic as a default destination exclusion for Z-Tunnel 2.0 Permits configuration of multiple trusted networks for ZIA-only licensed accounts Enables configuring the minimum Zscaler Client Connector version number displayed in the portal
+1 more
show less
Supports using internal processes and endpoint security services (e.g., Carbon Black, CrowdStrike, SentinelOne) as device posture profile criteria
6 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-02-14
Feb 14, 2020
· release notes
Zscaler Client Connector 2.1 adds trusted networks, auto-populate IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. username, and independent disable loopback restriction.
Display the connected broker name in the Private Access window Configure multiple trusted networks for use with ZPA applications Auto-populate the username field during IdP authentication Disable Loopback Restriction option works independently of the forwarding profile action
4 details in Everything
Client Connector — Release Upgrade Summary (2020) — 2020-02-14
Feb 14, 2020
· release notes
Zscaler Client Connector 3.17.1 adds accessibility outlines, internal traffic tunneling for Windows 10, multicast exclusion in Z-Tunnel 2.0, MTU configuration, multi-trusted
Adds a visual accessibility feature displaying an outline around actively selected controls in the Zscaler Client Connector interface Enables tunneling internal traffic (e.g., app updates) through Zscaler on Windows 10 devices instead of direct connections Enables configuration of multiple trusted networks for accounts licensed for ZIA only Adds the ability to configure the Zscaler Client Connector Portal to display the minimum required connector version for specific features Supports using internal processes and endpoint security services (e.g., Carbon Black, CrowdStrike, SentinelOne) as criteria in device posture profiles
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-02-07
Feb 7, 2020
· release notes
New SaaS SaaS Software delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. Security API for data at rest DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. and malware detection via integration, policies, and NSS feeds.
Adds SaaS Application Tenants configuration page to integrate sanctioned SaaS apps as tenants Adds Data Loss Prevention policy type within SaaS Security API Policies for data-at-rest DLP inspection Adds Malware Detection policy type within SaaS Security API Policies with exception support Adds configurable scan schedules in Scan Configuration for DLP and Malware policies Adds SaaS Security Report page for discovery and remediation summary
+5 more
show less
Adds SaaS Security Insights and Insights Logs pages for deep investigation of API results Adds NSS Feeds support specifically for SaaS Security Logs Adds SaaS Security log fields to the configurable output format in NSS Feeds Enables multi-selection with exclusion capability for reporting widgets like Insights Logs Adds new string match operators (Does Not Contain , Does Not Start With , Does Not End With , Is Null , Is Not Null ) to Insights Logs filters
10 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-01-30
Jan 30, 2020
· release notes
Client Connector 2.1.0.190 adds macOS Catalina support, multiple trusted networks, and auto-populated IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. username.
Adds trustedNetworks configuration to allow multiple trusted networks for ZPA applications Enables automatic username population during IdP authentication via a new configuration option Improves Private Access UI to display the connected broker name
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-29
Jan 29, 2020
· release notes
Zscaler launches a new Support Portal for ticket submission, monitoring, and case collaboration.
Launches the Zscaler Support Portal as the primary interface for submitting support tickets and tracking cases. Adds the ability to add team collaborators to support tickets via the ZIA Admin Portal.
2 details in Everything
└──▷ BREAKING ON UPGRADE
! Closed tickets more than 12 months old are no longer available in the system.
Private Access (ZPA) — Release Upgrade Summary (2020) — 2020-01-27
Jan 27, 2020
· release notes
Admin Portal now shows warnings for servers, groups, segments, and application segments with incomplete configuration.
Adds Admin Portal UI warnings when viewing or editing a server, server group, segment group, or application segment that is missing important configuration information.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-24
Jan 24, 2020
· release notes
ZIA gains CrowdStrike integration, Identity-based Block Override, AI/ML content categorization, and new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. /data types
CrowdStrike Partner Integration enables endpoint detection and response endpoint detection and response Endpoint detection and response, monitoring computers for suspicious behavior and providing investigation and response controls, such as isolating a device. visibility for Sandbox-detected malware via the CrowdStrike Falcon API.Enable Identity-based Block Override option under Policy > URL & Cloud App Control > Advanced Policy Settings allows authorized users to provide temporary access to blocked pages using company login credentials.Dynamic Content Categorization now supports AI/ML-based Content Categorization with extended coverage for Games, Health, Religion, Shopping and Auctions, and Sports categories. Five new predefined DLP dictionaries are available: Identity Card Number (China), National Identification Card Number (Taiwan), National Identification Number (France), National Identification Number (Spain), and Resident Registration Number (Korea). EDM templates now support a maximum of 5 billion cells.
+2 more
show less
New EDM Data Types for Identity Card Number (China), National Identification Card Number (Taiwan), National Identification Number (France), National Identification Number (Spain), and Resident Registration Number (Korea) can be selected when creating Exact Data Match templates. NSS feed output for tunnel logs now includes the %d{recordid} field.
7 details in Everything
└──▷ BREAKING ON UPGRADE
! The Enable Dynamic Content Categorization option is renamed to Enable AI/ML-based Content Categorization in Policy > URL & Cloud App Control > Advanced Policy Settings.
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-20
Jan 20, 2020
· release notes
ZIA adds Alcohol/Tobacco and Newly Registered Domains categories for CIPA compliance
Enables adding custom URLs to the Legal Liabilities super category within CIPA compliance settings
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-17
Jan 17, 2020
· release notes
ZIA adds recordid to NSS tunnel logs, user name obfuscation for remote assistance, and dynamic location groups with independent firewall evaluation.
└──▷ USE IT
Configure NSS feed to capture tunnel record IDs by adding the new field to the output format.
Adds %d{recordid} field to NSS feed output format for tunnel logs Enables manual selection to obfuscate user names in Remote Assistance (auto-obfuscates SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. users) Adds dynamic location groups that automatically update based on matching location attributes Introduces Zscaler Proxy Traffic firewall rule for independent evaluation of inner/outer 5-tuples in HTTP tunnel connections
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2020) — 2020-01-10
Jan 10, 2020
· release notes
ZIA adds Alcohol/Tobacco and Newly Registered Domains URL categories for CIPA compliance
Enables adding custom URLs to predefined categories under the URL super category Legal Liabilities . Displays Virtual ZENs or Virtual Service Edges in Admin Portal > Cloud Configuration based on subscription.
2 details in Everything
Client Connector — Client Connector App Release Summary (2020) — 2020-01-06
Jan 6, 2020
· release notes
Client Connector 1.5.2 on Android adds API level 29 support and log export via content provider
Zscaler Client Connector now uses API level 29 (Android 10) for most devices Log export is now handled via an Android content provider instead of direct file access
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The Cellular Quota feature is removed from Zscaler Client Connector profiles for Android in compliance with Google requirements
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-12-13
Dec 13, 2019
· release notes
ZIA adds CIPA URL categories and custom Legal Liabilities support; Virtual ZEN/Service Edge visibility in Admin Portal.
Adds Alcohol/Tobacco and Newly Registered Domains as new predefined URL categories for CIPA Compliance Rules Allows adding custom URLs to the Legal Liabilities sub-category under the URL super category for compliance workflows Admin Portal now displays only Virtual ZENs or Virtual Service Edges in Administration > Cloud Configuration based on subscription
3 details in Everything
└──▷ BREAKING ON UPGRADE
! TLS 1.0 and TLS 1.1 are no longer supported for the ZIA Admin Portal or Cloud Service API; browsers must support TLS 1.2 or higher
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-12-06
Dec 6, 2019
· release notes
ZIA adds SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection URL exemption, User Auth URL exemption, and full CRUD CRUD The four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. for URL Filtering Policies via Cloud Service API.
Adds GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls endpoints to manage SSL inspection exemptions programmatically Adds GET /authSettings/exemptedUrls and POST /authSettings/exemptedUrls endpoints to manage user authentication URL exemptions Adds GET /urlFilteringRules, POST /urlFilteringRules, PUT /urlFilteringRules/{ruleId}, and DELETE /urlFilteringRules/{ruleId} endpoints for full lifecycle management of URL Filtering Policies via API Removes the deprecated GET /urlFilteringRules/lite endpoint from the Cloud Service API
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The GET /urlFilteringRules/lite resource is removed and will no longer function in requests to the Cloud Service API.
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-11-22
Nov 22, 2019
· release notes
ZPA introduces SCIM SCIM A standard for creating, updating and removing user accounts and groups across applications. It helps an identity provider keep access in sync when people join, change roles or leave. integration for automated user and group provisioning from IdPs
Enables configuring SCIM syncing between ZPA and an IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. via the Edit IdP Configuration window
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-11-22
Nov 22, 2019
· release notes
ZIA adds API endpoints for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection exemptions, URL filtering, and auth exemptions; removes deprecated /urlFilteringRules/lite.
Adds GET /sslSettings/exemptedUrls and POST /sslSettings/exemptedUrls to the Cloud Service API for managing SSL inspection exemption URLs Adds GET /urlFilteringRules, POST /urlFilteringRules, PUT /urlFilteringRules/{ruleId}, and DELETE /urlFilteringRules/{ruleId} to manage URL filtering policies via the Cloud Service API Adds GET /authSettings/exemptedUrls and POST /authSettings/exemptedUrls to the Cloud Service API for managing User Authentication exemption URLs Removes the deprecated /urlFilteringRules/lite resource from the Cloud Service API
4 details in Everything
└──▷ BREAKING ON UPGRADE
! The /urlFilteringRules/lite resource has been removed; scripts calling this endpoint will fail.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-11-19
Nov 19, 2019
· release notes
Zscaler ZIA adds Azure Virtual WAN partner integration for one-click IPSec tunnel configuration
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-11-15
Nov 15, 2019
· release notes
ZPA adds Private Service Edge hosting, provisioning keys, status diagnostics, and monitoring filters for public/private service edges in UI sections.
Adds support for ZPA Private Service Edge to host service edge functionality in your organization's environment Adds the Service Edge Provisioning Keys page to manage provisioning keys for Private Service Edge groups Adds the Service Edge Group page to view and manage groups for ZPA Private Service Edges Adds Service Edge Status Diagnostics to monitor and track all ZPA Public Service Edges and ZPA Private Service Edges
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-11-15
Nov 15, 2019
· release notes
ZIA drops TLS 1.0/1.1 support for Admin Portal and Cloud Service API
└──▷ BREAKING ON UPGRADE
! Connections to the Admin Portal and Cloud Service API using TLS 1.0 or TLS 1.1 are no longer accepted; clients must use TLS 1.2 or newer.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-11-01
Nov 1, 2019
· release notes
Adds CIPA Compliance feature with predefined URL filtering rule, control, and report.
Adds the Enable CIPA Compliance control to activate the CIPA compliance feature. Adds the CIPA Compliance Report to view insights on blocked traffic and users.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-10-30
Oct 30, 2019
· release notes
ZPA introduces Client Forwarding Policy to control Z App request forwarding and bypass settings.
Adds Client Forwarding Policy capability to define when application requests are forwarded to ZPA from the Zscaler Client Connector (Z App), with actions: Bypass ZPA , Only Forward Allowed Applications , or Forward to ZPA . Updates the Add Application Segment window's Bypass setting options to include Use Client Forwarding Policy (formerly Never ), Always , and On Corporate Network .
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The Bypass option formerly labeled Never is now named Use Client Forwarding Policy in the Add Application Segment window.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-10-30
Oct 30, 2019
· release notes
ZIA adds support for Microsoft Visual Studio (.vsix) file type in File Type Control policies.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-10-25
Oct 25, 2019
· release notes
ZIA adds CIPA Compliance feature with predefined rule, control, and report
Introduces Enable CIPA Compliance control to activate the preconfigured CIPA Compliance Rule for URL filtering Adds CIPA Compliance Report providing traffic and user insights into blocked access based on the CIPA rule
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-10-24
Oct 24, 2019
· release notes
ZIA adds .vsix support to File Type Control and drops TLS 1.0/1.1 for admin access
Adds Microsoft Visual Studio (.vsix) as a selectable file type in File Type Control rules. Removes support for TLS 1.0 and TLS 1.1 when accessing the ZIA Admin Portal or Cloud Service API.
2 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-10-18
Oct 18, 2019
· release notes
ZPA Admin Portal adds CSV export for dashboard widgets and displays app ports.
Adds the ability to download application and user information to a .csv file for the Applications Accessed, Applications Discovered in Past 14 Days, and Recent Users widgets on the Applications and Users dashboards. Applications Accessed and Applications Discovered in Past 14 Days widgets now display the application's port number.
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-10-18
Oct 18, 2019
· release notes
ZIA introduces Virtual Service Edge, a horizontally scalable virtual form factor for the Public Service Edge (ZEN), available across zia.net, zscalerone.net, zscalertwo.net, and zscloud.net.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-10-11
Oct 11, 2019
· release notes
ZIA adds Virtual Service Edge support, per-location IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control, EDNS0 DNS, and OneDrive split
Adds support for ZIA Virtual Service Edge for horizontally scalable, virtual deployments of the full ZEN feature set Adds Enable IPS Control setting to allow signature-based inline protection at the location or sub-location level when Firewall Control is enforced Adds EDNS0 client subnet option support to authoritative DNS servers for more accurate DNS responses based on user location
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-10-04
Oct 4, 2019
· release notes
ZIA adds EDNS0 subnet support, per-location IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control, new Firewall log fields, and OneDrive tenant splitting.
Adds EDNS0 client subnet option support to Zscaler authoritative DNS servers for accurate origin identification. Enables Enable IPS Control at the Location or Sub-Location level alongside Enforce Firewall Control for inline signature-based detection. Adds new Firewall log fields to NSS Feeds: %s{threatcategory}, %s{threatname}, and %s{ipsrulelabel}. Splits OneDrive cloud application into OneDrive and OneDrive (Personal) in Cloud App Control Policy under File Sharing.
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-09-27
Sep 27, 2019
· release notes
ZIA now distinguishes OneDrive Enterprise from OneDrive Personal in Cloud App Control policies
OneDrive cloud application is split into OneDrive and OneDrive (Personal) for separate access control
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-09-20
Sep 20, 2019
· release notes
ZIA adds inline IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control per location, EDNS0 client subnet support for authoritative DNS, and Executive Insights App admin roles.
Adds Enable IPS Control at a Location or Sub-Location to use signature-based detection to control and protect traffic inline Adds EDNS0 client subnet option support to Zscaler authoritative DNS servers for accurate origin identification Adds the Executive Insights App as a configurable target for admin roles across zscaler.net, zscalerone.net, zscloud.net, and zscalertwo.net Adds IPS Overview dashboard and new Firewall Logs filters: Threat Category , Threat Name , IPS Rule Name Adds new Firewall Insights data types: IPS Location , IPS Rule , IPS Threat Category , and IPS User
+2 more
show less
Adds IPS Rule Names , IPS Actions , Threat Names , and Threat Categories to NSS Feeds configuration options Adds new Firewall log fields to NSS Feed Output: %s{threatcategory}, %s{threatname}, %s{ipsrulelabel}
7 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-09-19
Sep 19, 2019
· release notes
ZPA adds User Portals section in Admin UI for managing end-user application access and downloads
Adds a new User Portal section in the ZPA Admin Portal main navigation menu to configure links, AUPs, and client download options New session status codes added: EXPTR_MT_TLS_SETUP_FAIL_VERSION_MISMATCH, EXPTR_MT_TLS_SETUP_FAIL_NOT_TRUSTED_CA, EXPTR_MT_TLS_SETUP_FAIL_CERT_CHAIN_ISSUE, EXPTR_MT_TLS_SETUP_FAIL_PEER
2 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-09-14
Sep 14, 2019
· release notes
ZIA adds EDNS0 client subnet support to authoritative DNS servers for location-aware responses.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-08-30
Aug 30, 2019
· release notes
ZIA adds inline IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. control with new log fields and filters for threat analysis
IPS Control allows enabling signature-based detection to control and protect traffic inline at a location or sub-location.New IPS Overview dashboard provides visualization of IPS data. Firewall Logs now support filters: Threat Category , Threat Name , IPS Rule Name , IPS Location , IPS Rule , IPS Threat Category , and IPS User . Firewall Insights gains new data types: IPS Location , IPS Rule , IPS Threat Category , and IPS User .
4 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-08-16
Aug 16, 2019
· release notes
ZIA adds inline IPS IPS An intrusion prevention system, inspecting activity and blocking traffic or actions that match its security rules. It adds active enforcement to detection. Control per location with new logs, filters, and dashboard
Enables IPS Control as an enforcement option alongside Enforce Firewall Control at Locations or Sub-Locations for inline signature-based traffic protection. Adds the IPS Overview dashboard for visualizing IPS events in ZIA. Adds Threat Category , Threat Name , and IPS Rule Name filters to Firewall Logs. Adds new Firewall Insights data types: IPS Location , IPS Rule , IPS Threat Category , and IPS User . Adds IPS Rule Names , IPS Actions , Threat Names , and Threat Categories to NSS Feeds output.
+1 more
show less
Adds %s{threatcategory}, %s{threatname}, and %s{ipsrulelabel} fields to the Firewall Log fields in NSS Feed Output.
6 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-08-10
Aug 10, 2019
· release notes
ZIA adds TLD TLD The rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. categories for URL filtering and ML-enhanced sandbox verdicts
Adds TLD Categories as criteria in URL filtering policies to match traffic by top-level domain Augments Sandbox static analysis with machine learning to improve malware detection accuracy Increases allowed Microsoft 365 tenant domains from 100 to 250 per policy
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-08-02
Aug 2, 2019
· release notes
ZIA adds machine learning to Sandbox and TLD TLD The rightmost label in a domain name (e.g., .com, .gov, .uk), maintained by IANA's root zone. Cyber tools filter or pivot on TLDs to scope scans, flag suspicious registrations, or classify traffic by geography or type. -based URL filtering; increases MS365 tenant limit.
Adds top-level domain (TLD) categories as a matching criterion in URL filtering policies Enhances Sandbox static analysis with machine learning capabilities for improved malware detection Increases allowed Microsoft 365 tenant domains from 100 to 250
3 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-07-20
Jul 20, 2019
· release notes
ZIA adds location-level option to enforce Zscaler Client Connector SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection settings.
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-07-12
Jul 12, 2019
· release notes
ZPA updates include UI enhancements like remove icons and expanded SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. support up to 1MB for Browser Access.
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-06-30
Jun 30, 2019
· release notes
ZPA Admin Portal adds session timeout, role-based audit log visibility, search, and settings access control update.
Adds Admin Portal Session Timeout field on the Administration > Settings page to specify inactivity logout duration Grants ZPA Read Only Administrator role permission to view audit logs Updates Authentication access control section for ZPA admin roles to include Settings Enables search by application segment name, domain name, or IP address on the Administration > Application Segments page Moves Remote Assistance field from the Settings page to the Help menu
5 details in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-28
Jun 28, 2019
· release notes
ZIA adds Z-Tunnel 2.0, AES-GCM AES-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. IPSec, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. types/fields, Tunnel Insights, and several cloud app controls.
Adds Z-Tunnel 2.0 support for forwarding TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , and ICMP via DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. /TLS Adds AES-128-GCMAES-128-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. , AES-192-GCM, and AES-256-GCM with 128-bit ICV to IPSec IKE Phase 2 Adds four new predefined DLP dictionaries: ABA Bank Routing Numbers, Individual Taxpayer Registry ID (Brazil), National Health Service Number (UK), and Standardized Bank Code (Mexico) Adds ${DLPMD5} and ${TRANSACTION_ID} macros for DLP Notification Templates Adds %s{dlpmd5}, %d{dlpidentifier}, and %s{dlpdicthitcount} fields to NSS Web Logs feed output
+26 more
show less
Adds /vips endpoint to the cloud service API Adds DLP MD5 and DLP Identifier filters in Web Insights Logs Adds interactive report SSL Traffic Overview under Analytics > Interactive Reports Adds Tunnel Insights (Analytics > Tunnel Insights) for monitoring IPSec/GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnel health Adds Allow due to insufficient app data Action in Firewall Insights Logs Enables explicit proxy mode configuration for Index Tool VM Adds support for \d, \D, \s, \S, \w, and \W shorthand character classes in DLP Dictionary patterns Adds new cloud app controls for Google Classroom, MailBigFile, Meetup, and Zoom Adds Online Gaming category and Executable Scripts (py, sh, bat) selection to File Type Control Adds ability to select specific URL categories for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection policy Adds Confidence Score Threshold option for National Insurance Numbers (UK) DLP dictionary Adds scheduled updates capability for Exact Data Match (EDM) templates Adds support for Microsoft Outlook Message (.msg) and Password Protected/Encrypted file types in external DLP policies Adds custom RTSP and PPTP port configuration via Services Forwarded to RTSP and Services Forwarded to PPTP options Allows blocking ransomware in Malware Protection policy Expands Sandbox Policy rule file type support to .7z, .bz/.bz2, .tgz/.gtar/.tar, .xlam, .xlsb, .slk, and .ppsx Splits Outlook cloud application into Outlook and Outlook (Personal) with separate access control Adds SSL Cipher Filters for encrypted SSL traffic in Web Insights Logs Adds Zscaler Client Connector Portal as IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. automatic configuration Adds Response Signing SSL Certificate selection for Identity Proxy SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. responses Allows allow/blocking of non-RFC compliant HTTP/HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic via new setting Enables RTSP and PPTP options in Auto Proxy Forwarding for Non-defined Ports Increases maximum custom DLP dictionaries to 79 and engines to 47 Increases Location Groups limit to 256 per organization Increases Custom URLs limit to 25,000 across all policies Adds End User Notification capability for unauthenticated traffic at location/sub-location level
31 details in Everything
└──▷ BREAKING ON UPGRADE
! Field names on SSL Inspection page changed: 'Do Not Inspect Sessions to these URL Categories' is now Exempt These URL Categories from Inspection & Other Policies , 'Do Not Inspect Sessions to these Hosts' is now Exempt These Hosts from Inspection & Other Policies , Do Not Inspect these Applications is now Exempt These Applications from Inspection & Other Policies ; in Advanced Settings, 'Enable policies for SSL global exempted domains' is now Override Zscaler Global SSL Exemptions List
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-06-14
Jun 14, 2019
· release notes
ZIA adds AES-GCM AES-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. IPSec, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros/fields, Z-Tunnel 2.0, and API/vIPS endpoint
Adds support for AES-128-GCMAES-128-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. , AES-192-GCM, and AES-256-GCMAES-256-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. encryption algorithms for IKE Phase 2 in IPSec VPN VPN A virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnels. Adds ${DLPMD5} and ${TRANSACTION_ID} macros to DLP Notification Templates for identifying file hashes and transaction IDs. Adds new NSS Feed output fields: %s{dlpmd5}, %d{dlpidentifier}, %s{devicename}, %s{deviceostype}, %s{deviceosversion}, %s{devicemodel}, %s{deviceappversion}, and %s{ua_token}. Adds /vips API endpoint to retrieve a flat list of virtual IP addresses for Zscaler cloud data centers. Introduces Z-Tunnel 2.0, an HTTP tunnel using DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. /TLS that supports TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , and ICMP traffic forwarding.
+4 more
show less
Adds DLP MD5 and DLP Identifier filters to Web Insights Logs to locate specific DLP transactions. Adds %s{dlpdicthitcount} field to NSS Feeds and a match count display to the DLP Dictionaries filter in Web Insights Logs. Enables scheduling regular updates for Exact Data Match (EDM) templates. Adds new Cloud App Control apps: Google Classroom, MailBigFile, Meetup, Zoom, and splits Outlook into Outlook and Outlook (Personal).
9 details in Everything
└──▷ BREAKING ON UPGRADE
! The following SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection page fields are renamed: 'Do Not Inspect Sessions to these URL Categories' becomes Exempt These URL Categories from Inspection & Other Policies ; 'Do Not Inspect Sessions to these Hosts' becomes Exempt These Hosts from Inspection & Other Policies ; Do Not Inspect these Applications becomes Exempt These Applications from Inspection & Other Policies .! The 'Enable policies for SSL global exempted domains' option in Advanced Settings is renamed to Override Zscaler Global SSL Exemptions List .! The existing %s{ua} NSS field now includes the full user agent string; tokenized access requires adding the new %s{ua_token} field.
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-31
May 31, 2019
· release notes
ZIA adds AES-GCM AES-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. and ECDHE_ECDSA for IPSec/SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. , new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. fields/macros, Z-Tunnel 2.0, /vips API endpoint, new cloud apps, and UI enhancements.
Adds AES-128-GCMAES-128-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. , AES-192-GCM, and AES-256-GCM with 128-bit ICV as supported IPSec encryption algorithms for IKE Phase 2 Adds support for ephemeral ECDH with ECDSA ECDSA The elliptic-curve signature algorithm behind most TLS certificates, blockchains and many hardware keys. It is one of the algorithms post-quantum signatures are meant to replace. signatures (ECDHE_ECDSA cipher suite) for SSL inspection to ensure Perfect Forward Secrecy Adds new ABA Bank Routing Numbers , Individual Taxpayer Registry ID (Brazil), National Health Service Number (UK), and Standardized Bank Code (Mexico) predefined DLP dictionaries Adds four new cloud apps: Google Classroom , MailBigFile, Meetup , and Zoom for use in Cloud App Control Adds a new Allow due to insufficient app data Action in Firewall Insights Logs
+29 more
show less
Adds DLP MD5 and DLP Identifier filters to Web Insights Logs, plus the DLP Dictionary filter with match count display Adds new NSS web log fields: %s{dlpmd5}, %d{dlpidentifier}, %s{dlpdicthitcount}, %s{devicename}, %s{deviceostype}, %s{deviceosversion}, %s{devicemodel}, %s{deviceappversion}, %s{ua_token} Adds new DLP Notification Template macros: ${DLPMD5} and ${TRANSACTION_ID} Adds new NSS web log field macro: %s{dlpdictcount} for dictionary hit counts Adds a /vips endpoint to the cloud service API to retrieve a flat list of all virtual IP addresses (VIPs) Extends SSL Cipher Web Insights filters (Certificate Expiry , Cipher Certificate Validations , Client Connection Ciphers , etc.) to encrypted SSL traffic Adds Tunnel Insights page at Analytics > Tunnel Insights for viewing IPSec and GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnel data and health status Adds Online Gaming category in File Type Control, composed of Sega Master System (.sms), Game Boy Advance (.gba), Nintendo DS (.3ds, .nds), Playstation (.psx), Sega 32X (.32x), and XBox (.xipo, .xtfo, .xbeh) file types Adds Executable Scripts (py, sh, bat) selection under the Executable category in File Type Control Makes FTP Control available to organizations with a Standard Firewall subscription for controlling FTP over HTTP and native FTP traffic Allows allowing or blocking non-RFC compliant HTTP traffic on HTTP/HTTPS HTTPS HTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. ports via an option in Advanced Settings Adds ransomware allow/block control within the Malware Protection Policy Extends Sandbox Policy rule support to 7-Zip (.7z), Bzip2 (.bz, .bz2), Tar (.tgz, .gtar, .tar), Excel Add-In (.xlam), Excel Binary Workbook (.xlsb), Symbolic Link (.slk), and PowerPoint Show (.ppsx) file types Adds Medical Information DLP dictionary enhancements with additional disease/treatment/drug phrases and a configurable Confidence Score Threshold for the National Insurance Numbers (UK) dictionary Enables configuration of an Index Tool VM in explicit proxy mode Increases maximum custom DLP dictionaries to 79 and custom DLP engines to 47 Adds scheduled updates capability for Exact Data Match (EDM) Templates Adds the ability to select ABA Bank Routing Numbers , Individual Taxpayer Registry ID (Brazil), National Health Service Number (UK), and Standardized Bank Code (Mexico) as Data Types in EDM templates Adds new Shorthand Character Classes (\d, \D, \s, \S, \w, \W) support for DLP Dictionary patterns Adds Microsoft Outlook Message (msg) as a selectable File Type in DLP policies with external engines, and Password Protected / Encrypted option for such policies Allows selection of RTSP and PPTP options for Auto Proxy Forwarding for Non-defined Ports, and configuration of custom ports via Services Forwarded to RTSP and Services Forwarded to PPTP options Introduces interactive report SSL Traffic Overview under Analytics > Interactive Reports > Web Activity for aggregated SSL transaction metrics Adds filtering by word/phrase/number, remove-all/remove-page actions, and 500 items per page view in Item Lists Splits the Outlook cloud application into Outlook and Outlook (Personal) for Cloud App Control, with SSL bypass logic tied to Microsoft-Recommended One Click Configuration Adds Response Signing SSL Certificate selection for Identity Proxy settings under Administration > Identity Proxy Settings Adds End User Notification (EUN) capability for unauthenticated traffic sent through a location or sub-location Adds Zscaler Client Connector Portal as IdP configuration simplification under Administration > Authentication Settings with automatic URL and certificate setup Updates terminology on SSL Inspection page: Do Not Inspect Sessions to these URL Categories becomes Exempt These URL Categories from Inspection & Other Policies , etc., and Enable policies for SSL global exempted domains becomes Override Zscaler Global SSL Exemptions List Adds URL Count Display across multiple Admin Portal sections (Custom URLs, Authentication Exempted URLs, etc.) showing usage against the 25,000 custom URL limit
34 details in Everything
└──▷ BREAKING ON UPGRADE
! The terminology on the SSL Inspection page changes: 'Do Not Inspect Sessions to these URL Categories' is renamed to Exempt These URL Categories from Inspection & Other Policies , 'Do Not Inspect Sessions to these Hosts' is renamed to Exempt These Hosts from Inspection & Other Policies , and Do Not Inspect these Applications is renamed to Exempt These Applications from Inspection & Other Policies . On Advanced Settings, 'Enable policies for SSL global exempted domains' is renamed to Override Zscaler Global SSL Exemptions List .! The existing %s{ua} NSS web log field now includes the full user agent string; the tokenized version requires adding the new %s{ua_token} field.
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-05-23
May 23, 2019
· release notes
ZPA now supports configuring multiple Identity Providers for user and admin Single Sign-On.
Enables adding and configuring multiple IdPs for user and admin SSO SSO Single sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. via the Add IdP Configuration window Allows access policy and timeout policy rules to filter based on SAML SAML A standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. attributes from specific or multiple configured IdPs
2 details in Everything
└──▷ BREAKING ON UPGRADE
! The Both setting is removed as an option for the Single Sign-On field in new IdP IdP A service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. configurations
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-17
May 17, 2019
· release notes
ZIA adds AES-GCM AES-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. for IPSec, Z-Tunnel 2.0, DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros, and new cloud app controls.
Adds support for AES-128-GCM AES-128-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. , AES-192-GCM, and AES-256-GCM AES-256-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. with 128-bit ICV in IPSec IKE Phase 2 Introduces Z-Tunnel 2.0 using DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. or TLS to forward all TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , and ICMP traffic Adds ${DLPMD5} and ${TRANSACTION_ID} macros for DLP notification templates and %s{dlpmd5}, %d{dlpidentifier}, %s{dlpdicthitcount} fields for NSS feeds Adds /vips API endpoint to retrieve a flat list of all virtual IP addresses for Zscaler cloud Enables selection of URL categories for SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection policies
+1 more
show less
Adds Allow due to insufficient app data action in Firewall Insights Logs
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The 'Do Not Inspect Sessions to these URL Categories' field is renamed to Exempt These URL Categories from Inspection & Other Policies ! The 'Do Not Inspect Sessions to these Hosts' field is renamed to Exempt These Hosts from Inspection & Other Policies ! The Do Not Inspect these Applications field is renamed to Exempt These Applications from Inspection & Other Policies ! The 'Enable policies for SSL global exempted domains' option is renamed to Override Zscaler Global SSL Exemptions List
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-05-13
May 13, 2019
· release notes
ZPA adds Dashboard aggregations, multi-value filters in Diagnostics, TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. health checks for UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. connectors, and new TLS session status codes.
Adds aggregation widgets (Access Policy Blocks, Successful Transactions) to the Applications Dashboard, replacing the deprecated Errors widget Enables multi-value filters and a new Query Builder in the Diagnostics and Live Logs pages for sharing queries across admins Configures App Connectors to perform TCP health checks alongside UDP for LDAP LDAP A protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. (389), Kerberos Kerberos A network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. (88), and DNS (53) Introduces Info session status codes MT_CLOSED_TLS_CONN_GONE_AST_CLOSED and MT_CLOSED_TLS_CONN_GONE_CLIENT_CLOSED for TLS connection closure events Moves BRK_MT_TERMINATED_IDLE_TIMEOUT from Policy Block to Info status code, simplifying idle timeout tracking
5 details in Everything
└──▷ BREAKING ON UPGRADE
! The BRK_MT_SETUP_FAIL_REAUTH_EXPIRED status code no longer applies to Zscaler Client Connector 1.4.3 and later versions
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-13
May 13, 2019
· release notes
ZIA enhances SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. inspection granularity by introducing URL category targeting within the SSL Inspection policy.
Allows administrators to refine SSL inspection scope by selecting specific URL categories rather than inspecting all traffic.
1 detail in Everything
Internet & SaaS (ZIA) — Release Upgrade Summary (2019) — 2019-05-03
May 3, 2019
· release notes
ZIA adds Z-Tunnel 2.0, AES-GCM AES-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. IPSec, new DLP DLP Data Loss Prevention: a category of controls that inspect and block sensitive data from leaving an organisation via email, web, or removable media, giving cyber tools a policy enforcement layer over data in motion and at rest. macros, /vips API, and Tunnel Insights.
└──▷ HOW TO FIND IT
Monitor tunnel health and status in the new UI panel.
📍 Analytics › Tunnel Insights
Zscaler introduces Z-Tunnel 2.0, an HTTP tunnel using DTLS DTLS A variant of TLS adapted for UDP, standardized by the IETF, that adds handshake reliability and replay protection without sacrificing datagram semantics — letting cyber tools encrypt low-latency or connectionless traffic. /TLS to forward TCP TCP A network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. , UDP UDP A network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. , and ICMP trafficAdds support for AES-128-GCMAES-128-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. , AES-192-GCM, and AES-256-GCMAES-256-GCM AES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. encryption algorithms in IPSec IKE Phase 2 New /vips API endpoint retrieves a flat list of all virtual IP addresses (VIPs) for the cloud DLP NSE macros ${DLPMD5} and ${TRANSACTION_ID} added to notification templates; NSS logs gain %{dlpmd5}, %{dlpidentifier}, and %{dlpdicthitcount} fields Tunnel Insights page (Analytics > Tunnel Insights ) visualizes IPSec/GRE GRE A tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. tunnel health and status
+1 more
show less
New Allow due to insufficient app data Action in Firewall Insights Logs
6 details in Everything
└──▷ BREAKING ON UPGRADE
! The field Do Not Inspect Sessions to these URL Categories on the SSL SSL A cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Inspection page is renamed to Exempt These URL Categories from Inspection & Other Policies ! The field Enable policies for SSL global exempted domains in Advanced Settings is renamed to Override Zscaler Global SSL Exemptions List
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-04-05
Apr 5, 2019
· release notes
ZPA updates the Admin Portal UI with consolidated menus and search capabilities, while enhancing diagnostics with new App Connector session status visibility.
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-03-19
Mar 19, 2019
· release notes
ZPA enables Segment Group Policy migration in Admin Portal and adds a copy button for App Connector Provisioning Key
Adds a copy button for the Copy Provisioning Key field in the Add App Connector window > 6. Deploy App Connector section.
1 detail in Everything
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-02-13
Feb 13, 2019
· release notes
ZPA updates Access and Timeout Policy UI with collapsible tables and renamed columns
Adds the ability to expand/collapse all rows within Access Policy and Timeout Policy tables in the ZPA Admin Portal Renames the Rule Action and Criteria column to Rule Action on the Access Policy page, showing only Allow Access or Block Access Renames the Rule Action and Criteria column to Timeouts on the Timeout Policy page, displaying Authentication and Idle Connection Timeout settings Renames Device Posture Profiles to Zscaler Client Connector Posture Profiles in the Add/Edit Access Policy window
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-02-05
Feb 5, 2019
· release notes
ZPA adds Custom Support Portal for MSSPs and UI enhancements to Admin Portal
Adds the ability for Managed Security Service Provider (MSSP MSSP A Managed Security Service Provider: a third-party company that operates cyber tooling and monitoring on behalf of clients, letting organizations outsource detection, response, and compliance functions. ) partners to customize the Submit a Ticket URL in the ZPA Admin Portal Enables selecting all application segments or segment groups via drop-down menus Adds search and clear selection capabilities to drop-down menus on the Audit Logs page Allows expanding or collapsing all rows within tables on supported pages
4 details in Everything
Private Access (ZPA) — Release Upgrade Summary (2019) — 2019-01-23
Jan 23, 2019
· release notes
ZPA Admin Portal adds App Connector Group fields, Double Encryption status, and certificate expiration icons to Diagnostics and Certificates pages.
Adds App Connector Group Name and App Connector Group ID columns to the User Activity Diagnostics and Application Diagnostics pages Adds a Double Encryption field to the Application Diagnostics page Renames the Application Segment column to Application in diagnostics views Renames the Domain or IP Address field under the Application column to Application in diagnostics views Removes mailto:// hyperlinks from admin names and enables search functionality in the Administrators page
+1 more
show less
Adds visual indicators (icon and tooltip) for certificate expiration status on Enrollment Certificates and Browser Access Certificates pages
6 details in Everything