The thoughts and opinions in this post are my own and do not necessarily reflect those of Zscaler.

Zscaler is a global cloud-based information security company that provides Internet security, web security, next generation firewalls, sandboxing, SSL inspection. +3 - saab - That was very nasty. POSITION DESCRIPTION: The Mobile team at Zscaler is responsible for developing a cross-platform client application for Windows, MacOS, Android and IOS, to securely steer endpoint traffic to Zscaler cloud. You will be the MS Windows programming domain expert on this team and bring your endpoint software development experience to the team. Built 100% in the cloud, the Zscaler global cloud delivers the entire gateway security stack as a service. By securely connecting users to their applications, regardless of device, location, or network, Zscaler is transforming enterprise security. This section provides the whitelisting rules for Zscaler Client Connector: If your organization uses GPO to push policies to both Windows 64-bit and Windows 32-bit systems, then add the Whitelisting instructions for both the versions in your GPO policy. Zscaler Client Connector 1.5 (or later) doesn’t support the fciv.exe file. Zscaler: The Only Leader in the 2020 Gartner Magic Quadrant for Secure Web Gateways. Read the Report. The only zero trust platform that securely connects any user, any device, and any app over any network. ProvenTrusted by over 450 of the Forbes Global 2000.

In this guide, we’ll walkthrough how to configure Microsoft Intune from scratch and use it to deploy the Zscaler Client Connector agent (ZCC) - formerly known as Zscaler Client Connector (ZCC).

Due to length, I’ve split this into two posts (the orginal was over 8000 words):

This post covers deployment on Windows and macOS.
The other post, available here, covers iOS and Android.

I suggest you use the Table of Contents to jump to the section that you need.

According to Microsoft:

Microsoft Intune is a cloud-based service that focuses on mobile device management (MDM) and mobile application management (MAM).

With Intune, you can:

Set rules and configure settings on personal and organization-owned devices to access data and networks.
Deploy and authenticate apps on devices – on-premises and mobile.
Be sure devices and apps are compliant with your security requirements.

In order to access Intune, you need to have either a Microsoft 365 or Enterprise & Mobility E3/E5 subscription. If you’re using a free Azure account, you’ll need to sign up to a trial, or pay per user (which can get costly).

Scott Bullock of Zscaler (@scottyb) has posted a great 10 minute video in their community forum that runs through the user experience of enrolling a fresh Windows 10 device into Intune. ZCC is automatically pushed out and transparently authenticated for both ZIA and ZPA.

When adding an app to Intune, you’ll be prompted to allocate the groups of users (or devices) that the app will be rolled out to. Hence before beginning, ensure you have the users of Zscaler inside of an AD or Azure AD group that you can assign the Zscaler Client Connector app to.

Depending on whether you want the ZCC app to be mandatory or optional for certain groups of users, you may want to divide your users into two groups:

The users to which the app is MANDATORY. Any user in this group will have the app automatically pushed out to them.
The users to which the app is OPTIONAL. The app will not be automatically pushed for users in this group, allowing them to go to the Company Portal and download it themselves if they choose.

In my examples below, I have 3 groups:

Group	Description
ZIA_Entitlement	This is the group of all users that are entitled to use Zscaler Internet Access (ZIA)
ZPA_Entitlement	This is the group of all users that are entitled to use Zscaler Private Access (ZPA). In my case, this is a subset of users from the ZIA_Entitlement group as I might not want to roll ZPA out to every user in the organization.
Zscaler - Mandatory	This group contains every user in the organization to which the ZCC app will be automatically rolled out to. Ie: The majority of users from the above two groups. If this is your organization, you might include the whole org in this group, except select users (eg: some from IT) for which the app will be optional.

We’ll be using the Microsoft Endpoint Manager console (MEM) to orchestrate Intune. You can log in using the same Azure Portal credentials here: https://endpoint.microsoft.com

(Optional) Setting the MDM Authority

If you’re using an existing Office 365 account and have been using the Office 365 MDM, you’ll need to change the MDM authority from Office 365 to Intune. This Microsoft help article will guide you through it.

This section will cover deploying ZCC onto Windows using Intune.

1. Download the Zscaler Client Connector MSI

To start you’ll need the .MSI installer for ZCC from the Zscaler Client Connector Portal. Log into the portal (either through ZIA or ZPA) and navigate to Administration > Zscaler Client Connector Store.

In the Windows panel, download the MSI for the latest 2.X.X version. Do not use the older 1.X.X releases.

2. Add a new Line-of-Business App

Add a new Line of Business (LoB) App

Back in the Apps menu of the MEM portal, navigate to Apps > All Apps > Add. In the panel that appears, scroll to the bottom and under the Other heading, select Line-of-business app.

When prompted to select an app package file, upload the MSI of the Zscaler Client Connector you downloaded above and click OK.

Customize the App Details

Fill in the required details about the app:

Field	Content
Name	Enter Zscaler Client Connector 2.X.X.X (where 2.X.X.X is the version number of the app - this will help you distinguish what version is being distributed by Intune)
Description	Enter Zscaler Client Connector
Publisher	Enter Zscaler, Inc
Ignore app version	Set to Yes. ZCC will automatically update itself once deployed, so Intune can safely ignore the version the user has installed after deployment.
Category	(Optional) Select an app category to allocate the Zscaler Client Connector to.
Command-line arguments	See below.

For the Command-line arguments section, enter the following (substituting in your own cloud and domain info):

Important!

When entering the cloud name, DO NOT enter the .net at the end. Eg: zscalertwo.net should be entered as zscalertwo
All command-line arguments should be on a single line with a space separating them. Do not linebreak each argument or they will fail.

Command-line arguments can be used for each platform to customize the install. For example, STRICTENFORCEMENT can be used to block access to the internet until your users enroll in the Zscaler Client Connector.

For a list and description of all the MSI customization options, scroll down to point #5 in this help article.

Click Next when ready to move onto the Assignments tab.

Assign Users to the App

There are two different sections you can allocate users or groups to depending on how you want the app rolled out to users:

Required = The app is MANDATORY for these users/groups. Any user or group in this section will have the App automatically pushed out to them.
Available for enrolled devices = The app is OPTIONAL for these users/groups. The app will not be automatically pushed and the users can go to download the app themselves from within the Company Portal.

Assign your users or groups to the ZCC app accordingly.

Click Next to continue and then Create on the following screen. Your Line-of-Business application will be created and the MSI will upload - be sure to wait until it’s complete.

Done!

This section will cover deploying ZCC onto macOS using Intune.

macOS requires a little bit more effort to get going than Windows does. We will need to do the following on a local macOS machine:

Download the Z

Zscaler Mac