Scribd
Upload
2 views2 pages

M03B Student Summary

Module 03B focuses on SAML, OIDC, and SCIM for Zscaler authentication, emphasizing SAML SSO with Entra ID as the production standard. It details setup steps for SAML, the use of OIDC as an alternative, and compares SCIM with JIT provisioning for user management. Key takeaways include the importance of enabling MFA for admin accounts and the capability of ZIA to support multiple IdPs for diverse organizational needs.

Uploaded by

shameel.lfc
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
2 views2 pages

M03B Student Summary

Module 03B focuses on SAML, OIDC, and SCIM for Zscaler authentication, emphasizing SAML SSO with Entra ID as the production standard. It details setup steps for SAML, the use of OIDC as an alternative, and compares SCIM with JIT provisioning for user management. Key takeaways include the importance of enabling MFA for admin accounts and the capability of ZIA to support multiple IdPs for diverse organizational needs.

Uploaded by

shameel.lfc
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

THE NETWORK GUY | Mastering Zscaler:

Hands On
Module 03B — SAML, OIDC & SCIM
Student Summary | Saturday 20 June 2026
─────────────────────────────────────────────────────
───────────────────

M03B is the most important authentication module for modern deployments. It covers SAML SSO with Entra
ID (the production standard), OIDC, SCIM provisioning, and JIT (Just-in-Time) provisioning as the free
alternative to SCIM.

1. SAML Fundamentals
 SAML 2.0 (Security Assertion Markup Language): federated authentication standard
 Three roles: Identity Provider (IdP) — Entra ID, Service Provider (SP) — ZIA/ZPA, User
 SP-initiated flow (most common): user hits ZIA → redirect to IdP (Entra ID) → user authenticates → SAML
assertion returned to ZIA → ZIA creates session
 SAML assertion: XML document containing user identity and attributes (email, name, groups,
department)
 ZIA uses attributes in the assertion to identify the user and apply group-based policy

2. SAML with Entra ID — Setup Steps


 Step 1: In Entra ID — create Enterprise Application for ZIA
 Azure Portal > Entra ID > Enterprise Applications > + New Application > Create your own
 Name: Zscaler ZIA SSO
 Step 2: Configure SAML in Entra ID
 Enterprise App > Single sign-on > SAML
 Basic SAML Configuration: enter ZIA's SP metadata (Entity ID and Reply URL from ZIA portal)
 Attributes & Claims: ensure NameID = [Link] (email format)
 Add Groups claim: Group Object IDs or group names — ZIA uses this for group-based policy
 Step 3: In ZIA — configure IdP
 Administration > Authentication Settings > SAML > + Add IdP
 Download Entra ID federation metadata XML and upload to ZIA
 ZIA generates SP metadata — download and upload to Entra ID
 Step 4: Assign users/groups to the Entra ID enterprise app
 Step 5: Test SSO in Entra ID and then test from ZIA
TIP: Entra ID free tier fully supports SAML SSO for unlimited applications. No P1 or P2 licence required for
SAML. This is the recommended setup for all lab exercises.

3. OIDC for ZIA and ZPA


 OIDC (OpenID Connect): an authentication layer on top of OAuth 2.0
 ZIA: OIDC can be configured as an alternative to SAML. Process similar — register ZIA as OAuth app in
Entra ID.
 ZPA: OIDC used for Browser Access (ZPA web app access without ZCC). Covered in M07.
 Entra ID supports OIDC via 'App Registrations' > new registration > OpenID Connect
 SAML is generally preferred for ZIA (simpler to configure with ZIA's metadata exchange)

4. SCIM vs JIT Provisioning


 SCIM (System for Cross-domain Identity Management): automatic user/group synchronisation from IdP to
ZIA
 Users created in Entra ID are automatically created in ZIA via SCIM
 Group changes in Entra ID are reflected in ZIA within minutes
 Requires: Entra ID P1 licence ($6/user/month)

 JIT (Just-in-Time) Provisioning: FREE alternative to SCIM
 User is created in ZIA automatically on their FIRST successful SAML login
 No P1 licence required — works with Entra ID free tier
 Enable in ZIA: Administration > Authentication Settings > SAML IdP > enable 'Auto-provision users'
 Limitation: user exists in ZIA only after first login (not pre-provisioned)
 Group sync: JIT picks up group attributes from the SAML assertion at each login
IMPORTANT: SCIM requires Entra ID P1. For lab exercises, use JIT provisioning (free). For production
deployments with large user populations, SCIM is preferred for full lifecycle management.

5. Multiple IdP Support


 ZIA supports multiple IdPs simultaneously — useful for M&A scenarios or multi-tenant orgs
 Configure: Administration > Authentication Settings > SAML > + Add IdP (add a second)
 ZIA assigns users to IdPs based on email domain or IP range
 Example: @[Link] users → IdP A (Entra ID), @[Link] users → IdP B (Okta)

6. Admin Authentication & MFA


 ZIA Admin Portal: admins can authenticate via Hosted DB or federated (SAML) login
 MFA for admins: strongly recommended. Enable via Administration > Administrator Management > MFA
 Entra ID MFA: if admin uses SAML login, Entra ID enforces MFA as part of the authentication flow
 Admin roles: Super Admin (full access), Policy Admin (policy only), Auditor (read-only)

Key Takeaways
 SAML with Entra ID is the production-standard ZIA authentication method. Entra ID free tier supports
SAML fully.
 SP-initiated flow: ZIA → Entra ID → SAML assertion → ZIA session. Users get SSO if already logged into
Entra ID.
 SCIM requires Entra ID P1. JIT provisioning is the free alternative — users created at first SAML login.
 Multiple IdPs: ZIA supports multiple SAML IdPs for multi-tenant/M&A scenarios.
 Enable MFA on all ZIA admin accounts — the Admin Portal controls your entire internet security policy.

You might also like