Skip to main content
Zscaler is a zero trust security platform for internet and private application access. Connect your Zscaler tenant to Oleria to bring user, group, and role access into your identity and access graph.

​
What Oleria discovers

  • User accounts and profile attributes synced from Zscaler’s directory.
  • Groups and their memberships.
  • Roles assigned to each user.
  • Identity posture signals, such as administrative role assignment.
Oleria uses this data for dormant account detection and access reviews, refreshed on Oleria’s regular sync schedule.

​
Prerequisites

  • A Zscaler Internet Access (ZIA) tenant that uses SAML for user authentication. Zscaler requires SAML when you use SCIM provisioning.
  • ZIA Admin Portal access with permission to edit identity providers.
  • Admin access on the Oleria platform to add a new integration.

​
Get your SCIM credentials from Zscaler

1

Enable SCIM provisioning in the ZIA Admin Portal

In the ZIA Admin Portal, go to Administration -> Identity -> Internet & SaaS -> Internet Authentication Settings -> Identity Providers, and edit your SAML identity provider. Turn on SCIM Provisioning. For details, see Zscaler’s Configuring SCIM article.
2

Copy your SCIM Base URL and Authentication Token

In the Edit IdP window, copy:
  • SCIM Base URL - the Base URL, in the format https://scim.<Zscaler Cloud>/<Organization ID>/<IdP ID>/scim.
  • Authentication Token - the Bearer Token. Select Generate Token if no token exists yet.
Generating a new bearer token replaces the existing one. If your identity provider already provisions ZIA over SCIM, update it with the new token too.

​
Connect Zscaler to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Zscaler tile.
2

Complete the connection form

Fill in the connection form:
3

Save the integration

Select Connect to validate the credentials and save the integration.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. Oleria syncs users, groups, and roles from Zscaler on its regular sync schedule once the initial sync completes.
If you regenerate the SCIM token in Zscaler, update the Authentication Token in Oleria by editing the integration.

​
Remediation actions

Oleria can also take these actions in Zscaler when the SCIM token can update users and groups:
  • Enable or disable a user account
  • Add or remove a user from a group
  • Create a new user or group
Oleria doesn’t check the token’s permissions until an action runs. If an action fails, confirm the token can update users and groups in Zscaler.

​
Contact us

For questions about this integration, contact us at support@oleria.com.