Android app directory · VPN and access
Zscaler Client Connector is the Android agent for Zscaler's internet and private access services. On Android Enterprise devices, IT can fill in the enrollment details ahead of time, so people open the app and are signed in through their company login instead of typing a domain and choosing a cloud. This page lists the twelve keys Zscaler documents for Android and Android on ChromeOS, what each one changes and how they combine. Zscaler notes that these keys only work when the app is installed from Google Play with Android Enterprise; an app sideloaded as an APK cannot be preconfigured.
Nomidzscaler.com.zscaler Common setups
Copy a setup into the managed configuration of a policy, then adjust the values. Each one uses only keys explained below.
Preset the domain and cloud so people open the app and land on the company sign-in page. Use this on single sign-on setups where each person types their own credentials. Leave cloudName out if your organization is provisioned on one cloud.
{
"userDomain": "corp.example.com",
"cloudName": "zscalertwo"
}Enroll once with no sign-in when the Zscaler Admin Console is your identity provider, for internet and SaaS access only. Zscaler requires deviceToken, cloudName and userDomain. It also prompts for contacts access if userName is missing or the contacts permission is not allowed, so fill in userName with an MDM macro and allow that permission in your policy.
{
"userDomain": "corp.example.com",
"cloudName": "zscalertwo",
"userName": "j.doe",
"deviceToken": "123456677754",
"autoEnrollWithMDM": 2
}Refuse rooted devices and emulators, turn on FIPS libraries and use your own DNS server for regulated environments.
{
"allowRunningOnRootedDevice": 0,
"allowRunningOnEmulator": 0,
"enableFips": 1,
"customDNS": "10.0.0.53"
}Managed configuration
Key names and value types come from the vendor’s documentation. The explanations are written by Nomid.
| Key | Type | What it does | Example |
|---|---|---|---|
| Enrollment and sign-in | |||
userDomain | Organization domain | Fills in the company domain so people skip the enrollment screen and go straight to the single sign-on page. It must match the domain in the SAML NameID, not just any domain the company owns. | corp.example.com |
cloudName | Zscaler cloud name | Picks the Zscaler cloud that receives the traffic, so people are not asked to choose one. Leave it out when the organization is provisioned on a single cloud. | zscalertwo |
userName | User name | Prefills the user name, up to 255 characters. Most MDM consoles can insert it with a macro. It only works when userDomain is also set. | j.doe |
deviceToken | Token from the Zscaler console | Lets the Zscaler service sign users in silently when the Zscaler admin console acts as the identity provider. It applies to internet and SaaS access, not to private access. | 123456677754 |
autoEnrollWithMDM | Choice: 0 off, 1 always, 2 once | Enrolls the app without user interaction. 1 enrolls again after every log out, 2 enrolls only the first time. It needs deviceToken, cloudName and userDomain to be set first. | 2 |
externalDeviceId | Device identifier | Ties the device in your MDM to the same device in the Zscaler console. Use an MDM macro so each device gets its own value. Needs app version 3.7 or later. | 123456677754 |
| Security and network behavior | |||
enableFips | Choice: 0 off (default), 1 on | Makes the app use FIPS-compliant libraries when it talks to Zscaler. Turn it on only if your organization requires that level. | 1 |
customDNS | DNS server address | Replaces the device's own DNS server with the one you name. Without it, the app uses whatever DNS the device already has. | 4.2.2.2 |
allowRunningOnRootedDevice | Choice: 0 block (default), 1 allow | Decides whether the app may run on a rooted device. Leave it at 0 for company devices. Needs app version 3.7 or later; older versions call it allowZccOnRootedDevice. | 0 |
allowRunningOnEmulator | Choice: 0 block (default), 1 allow | Decides whether the app may run inside an emulator. Teams testing on virtual devices may need 1; production fleets should keep 0. | 0 |
httpAuthAllowedHosts | Comma-separated host names | Names the hosts that may ask for HTTP Basic authentication or a client certificate during SAML sign-in. Requests from any other host are cancelled. Wildcards are not accepted. Needs app version 4.2 or later. | proxy.corp.example.com,idp.example.com |
Ownership | Label, up to 32 characters | Supplies the value that Zscaler's Ownership Variable device posture check compares against, for example to tell company devices from personal ones. | acmecorp |
Deploy with Nomid
Find it on Google Play from the policy’s apps list and choose how it is installed.
In the policy, set the app’s managed configuration with the keys and values from this page.
Devices in the policy receive Zscaler Client Connector and its configuration on their next sync.
Questions
zscaler.com.zscaler. This is the id in Zscaler's own Google Play link, and the name you search for when you add the app to a policy.
No. Zscaler says preconfiguration works only when the app comes from Google Play on a device managed with Android Enterprise.
Zscaler requires deviceToken, cloudName and userDomain to be set before autoEnrollWithMDM is set to 1 or 2. It also says people are asked to allow contacts access if userName is missing or the contacts permission is not allowed in your MDM, so the app can read the Google account name.
It covers the twelve keys in Zscaler's Android parameter table at the time of checking. Zscaler adds keys with new app versions, so check its table for newer ones.
Add the app to a Nomid policy, set its configuration and choose its permissions.
