Solution Brief

Zscaler + Microsoft
Deliver Zero Trust Security
Integrated comprehensive security that
increases productivity and delivers an
exceptional user experience© 2023 Zscaler, Inc. All rights reserved.

Organizations around the world are working to embrace the new normal,
with employees working from anywhere, on any device, along with thecontinued migration of on-premises applications to the cloud. While
generally considered a boon for employee satisfaction and app availability,
it also presents significant new challenges for organizations that seek toprotect their environments with networking and security products that were
never designed for remote workers or the cloud.
Securing these demanding modern work environments doesn’t have to come at the expense of youremployees’ happiness and productivity. Hybrid employees deserve quick, painless, and reliable connections
to their resources—not desk-pounding and frustration. Organizations running legacy security productsthat rely on VPNs and firewalls face incomplete security, inconsistent user access, an expanded attack
surface, and a poor user experience.
By replacing traditional networks and inbound/outbound security gateways with direct user-to-app andapp-to-app connections, Zscaler keeps your enterprise resources off the internet and invisible to threats.
Zscaler’s core services help Microsoft customers safely empower their workforces:• Zscaler Private Access (ZPA) makes problematic VPNs obsolete by connecting users directly to private
applications, bypassing networks altogether to keep precious enterprise resources invisible to threats andminimize the attack surface via a zero trust network access (ZTNA) cloud architecture.
• Zscaler Internet Access (ZIA) connects end users directly to the Internet and SaaS apps like Microsoft
365, reducing the cost and complexity of traditional secure web gateway products.
• Zscaler Digital Experience (ZDX) is a multi-tenant cloud-based monitoring platform that probes,
benchmarks, and measures digital experiences for every user within an organization.
Zscaler enables organizations to provide a secure and positive digital experience by delivering fast, reliable
access to all SaaS and private apps, cloud data stores, the Internet, and other enterprise assets.

thrilled to see some of the world’s largest“ I’m
enterprises including Sandvik, Siemens, and GE
use Zscaler and Microsoft to deliver fast anddirect access to Office 365, as well as applications
running on Azure.”
Satya Nadella, CEO of Microsoft© 2023 Zscaler, Inc. All rights reserved.

Solution Brief

2

Zscaler and Microsoft

bringing security closer to the user for fast accessand a positive digital experience. Zscaler’s modern

Zscaler and Microsoft solutions are tightly
integrated, providing our mutual customers withmodern, cloud native zero trust security whilearchitecture eliminates the cost, complexity andperformance challenges associated with legacy
VPN and firewall security products.

increasing user productivity and accessibility.
With thousands of customers benefiting from

Recent research from industry analyst Gartner

our platform solutions, it’s no surprise that Zscalerconfirms this requirement, stating that Zerohas been selected as the ISV Partner Winner ofTrust Network Access (ZTNA) is the fastest-

important Microsoft Awards such as Zero Trust

growing segment in network security, forecast

Champion of the Year and Microsoft ISV Partner

to grow 36% in 2022 and 31% in 2023, driven byof the Year, and is a founding member of thethe increased demand for zero trust protection

Microsoft 365 Networking Partner Program andfor remote workers and organizations’ reducing

the Microsoft Intelligent Security Association.

dependence on VPNs for secure access1.

The Zscaler Zero Trust Exchange is the world’s

Zscaler’s integration with Microsoft includes

largest inline security cloud with over 150 points

Azure Active Directory (AD), Microsoft Defenderof presence (PoPs) around the world, peering

for Cloud Apps, Microsoft Defender for Endpoint,with Microsoft globally. It acts as an intelligent

Intune, Azure Sentinel, Microsoft Information

switchboard to broker connections between

Protection, and more. Additionally, Zscaler

users, devices, and applications wherever they

enables organizations to accelerate their migration

reside. This distributed architecture ensuresof applications and environments to Microsoft

that any communication can be sent directly tosecurely. Let’s take a closer look at how Zscaler’s

the Microsoft Network efficiently and securely,

key Microsoft integrations benefit our customers.

IaaS/PaaSPRIVATE
CLOUD

Productivity and collaboration apps

Threat hunting and device posture

Microsoft 365 and Teams

Microsoft Defender for Endpoint

Identity management

App and data protection

Azure Active Directory

Microsoft Defender for Cloud Apps

Zero Trust
Exchange

Azure Information Protection

Endpoint management

Security operations

Microsoft Endpoint Manager

Microsoft Sentinel

Direct access to private apps, SaaS, internet
Zscaler ZPA, Zscaler ZIA

Optimized digital experience
Any userAny device

Any location

Zscaler ZDX

Figure 1: Zscaler and Microsoft enable the modern workforce with zero trust

Gartner: Gartner Identifies Three Factors Influencing Growth in Security Spending, October 13, 2022

1

© 2023 Zscaler, Inc. All rights reserved.

Solution Brief

3

Protection for Resources and Endpoints

been exposed. Microsoft Defender for Endpoint

Least privileged access provides users withthen utilizes the new file signature to quickly

only the minimum level of access necessary todetect, isolate, and remediate infected endpoints

perform job-specific activities. It is a crucial

throughout the organization.

element of information security that helps
organizations protect their sensitive data by
restricting unauthorized access and lateral
movement to business applications and resources.
The Zscaler Zero Trust Exchange takes this a stepfurther by first establishing a user’s identity andfull context for the connection request, such as
the user’s device, their location, the application inquestion, and its content.

For the securing and managing of corporate
and BYOD mobile devices, Zscaler integrates
with Azure AD and Microsoft Intune to provide
endpoint posture control enforcement. Microsoft
Intune also automates the deployment andprovisioning of Zscaler Client Connectors to
endpoints and applies Intune posture policies.
This integration also automates the assignmentof mobile apps to users, app configuration, andTo help establish the user’s identity, Zscaler

the removal of enterprise data from mobile apps.

integrates with Azure AD. This enables

User and group access to Zscaler resources areadministrators to utilize Azure AD to control

controlled within the Microsoft Intune console. To

access to Zscaler and allows authorized users

date, Zscaler has deployed over 36 million Client

to automatically sign-in to Zscaler using single

Connectors worldwide.

sign-on (SSO), multifactor authentication (MFA),
and conditional access to applications. Working
together, Zscaler and Azure AD deliver zero trust
network access to internal apps including Oracle,
SAP, and legacy-protocol workloads via Zscaler
Private Access (ZPA). They also ensure that only
authorized users have access to SaaS applications
and the internet via Zscaler Internet Access (ZIA),
enabling employees and partners to securely
work from anywhere.
Protecting endpoints against threats, including
zero day attacks is accomplished via integrationof the Zscaler Cloud Sandbox with Microsoft
Defender for Endpoint APIs, delivering Extended
Detection and Response (XDR) visibility. Zscaler
processes hundreds of billions of transactions
per day, detecting, blocking, and signaling
threats and zero day exploits. When the Zscaler“

We want to get
rid of VPNs. ZPAwith Azure AD will
make it possible for
employees to accessall internal apps
from anywhere.”
Jason Truong

VP, Network & Security
Engineering & Operations,
HumanaSandbox identifies a threat, it automaticallysignals Defender and requests the machine ID, filehash, and other data for the endpoints that have

© 2023 Zscaler, Inc. All rights reserved.

Solution Brief

4

External Apps

Private Apps

Access to Internet and SaaS
Block the bad, protect the good

Access to Private Apps
Direct access, no legacy VPN

Zscaler Internet Access

Zscaler Private AccessZero Trust
Exchange
Microsoft Sentinel
Ensure a great user experience
Zscaler Digital Experience (ZDX)
Microsoft 365 Defender

Azure Active Directory

Any userAny device

Figure 2: Zscaler and Microsoft provide zero trust security to SaaS, Internet, and private applications

Protection for Data and Apps

Zscaler Cloud DLP provides inline policy

The Zscaler + Microsoft integration allows you

enforcement based on data classification andto seamlessly secure data and applications in thelabeling created by MIP. Zscaler’s built-in file

cloud or wherever they reside. Zscaler Internet

decoding capability detects AIP’s labels, even for

Access (ZIA) provides secure access to internet

encrypted files, then takes appropriate actionand SaaS applications, while Zscaler Private

based on Zscaler’s DLP policies to enforce data

Access (ZPA) provides secure connectivity to

exfiltration controls and protect organizationsprivate apps. ZIA includes Cloud Data Lossfrom insider threats and compliance violations.

Prevention (DLP), Cloud Secure Web Gateway

Accordingly, if a document is classified as(SWG), Advanced Cloud Sandbox, and more.

confidential by AIP, Zscaler can prevent it from

Integration with Microsoft Information Protection

being uploaded to unsanctioned web and SaaS

(MIP), which helps organizations discover, classify,

applications, such as Google Drive or Dropbox.

label, and protect sensitive documents and emails
to prevent inappropriate sharing, provides layered
security that protects sensitive data.

© 2023 Zscaler, Inc. All rights reserved.

Solution Brief

5

Zscaler and Microsoft have also partnered totransaction data by user, device, application, andprovide a closed-loop Cloud Access Security

location in real time.

Broker (CASB) that discovers and controls
access to cloud applications and discovers
shadow IT across all users, regardless oflocation or connection. The integration of
Microsoft Defender for Cloud Apps with ZIA
provides both in-band and out-of-band CASB
protection along with Zscaler Nanolog Streaming
Service (NSS). Zscaler NSS streams real-time
log data into Defender, which uses the logs
to perform application discovery and classify
them as sanctioned, permitted, or unsanctioned

Zscaler accelerates and streamlines this processby adding a ZIA connector to the Azure Sentinel
console, which allows billions of threat logs andtransactions to be quickly ingested. As a result,
Sentinel has more data points, which enables
better threat intelligence, visibility, and detection.
This lets admins quickly view dashboards, createcustom alerts, and improve investigation toprotect users, data, and apps wherever
they reside.

applications. Administrators can then define

Fast, Secure Access to Azure, Microsoft 365,

security policies in Defender, which are enforced

Teams and Moreinline through Zscaler Internet Access to block

Organizations with legacy VPN and firewall

access to unsanctioned apps globally.

solutions face challenges when remote users

Protecting Infrastructure
Organizations with legacy security products facesignificant challenges when trying to aggregate
the logs from multiple firewalls, routers,
VPN concentrators, proxy servers, and otherdevices—often from multiple vendors withneed to access SaaS and Internet applications.
Network traffic must be backhauled to security
products in the data center for user access anddata inspection, resulting in network congestion,
poor performance, unhappy users, and increased
calls to the IT Help Desk.

different management consoles and interfaces.

The Zscaler Zero Trust Exchange is the world’s

Zscaler and Microsoft integrations enhancelargest inline security cloud with over 150 points

and simplify the identification, prioritization,of presence (PoPs) around the world, peeringand remediation of threats while proactively

with Microsoft globally. Our platform solves

hunting them as well. For example, Azure

the challenges associated with legacy security

Sentinel provides SIEM and SOAR capabilities,

architectures, with Zscaler Internet Access (ZIA)

and integrates with Zscaler Internet Access (ZIA)

enabling local breakouts for fast, direct access toand Zscaler Nanolog Streaming Service, which

Microsoft 365, eliminating reliance on VPNs andconsolidates logs from all users into a central

backhauling traffic to the data center.

repository. This enables administrators to analyze© 2023 Zscaler, Inc. All rights reserved.

Solution Brief6

In addition, Microsoft 365 traffic can be prioritized

detect and resolve user connectivity issues soover other traffic (e.g. YouTube or general internet

they can keep users happy and productive while

traffic) by using Zscaler Bandwidth Control.

reducing calls to the IT Help Desk.

Zscaler also automatically whitelists Microsoft
365 traffic, as recommended by Microsoft. Plus,
Zscaler fingerprints all Microsoft 365 applications
and frequently updates them, eliminating thechallenges caused by VPNs and firewalls that
include tracking URL and IP address changes,
which result in inconsistent access and delays inapplying product updates. Zscaler is a founding
member of the Microsoft 365 Networking Partner
program with traffic from thousands of enterprisecustomers running through our Zero Trust
Exchange every day.

Zero Trust Security for Cloud Workloads
Zscaler Workload Communications reimagines
cloud connectivity by enabling zero trust forcloud workloads, delivering simple, secureaccess for workloads to the internet and private
applications. Unlike legacy network solutions,
Workload Communications provides a directto-Azure architecture using the proven Zscaler
Zero Trust Exchange platform to verify trust
based on identity and context, enabling secure
workload-to-internet and workload-to-workload
communications across multiple regions andWorkforce satisfaction is critical, and Zscaler

Azure Availability Zones and workload-to-

and Microsoft balance zero trust security withworkload communications within an Azure

a positive, reliable experience for end users

environment.

that also provides organizations a competitive
advantage as they seek to attract and retain thenext generation of employees. Zscaler ZDX, ourdigital experience monitoring solution, seamlessly
integrates with Microsoft Teams through secure
APIs to access granular user and application
telemetry data within a single platform. This,in conjunction with networking, endpoint, andperformance signals from other apps, allows
ZDX to run powerful correlations and machine

Workload Communications eliminates the
network attack surface by directly connecting
workloads to the internet and to private
applications using a full proxy architecture. This
dramatically simplifies connectivity by eliminatingrouting, VPNs, transit gateways, transit hubs, andfirewalls, while allowing for flexible forwardingand easy policy management by using the proven
ZIA and ZPA policy framework.

learning. The result? IT teams are able to quickly“

We rolled out ZIA to our entire environment over 200,000 devices. Using it with Microsoft
365 gives our users a better experience…”
Jason Truong, VP, Network & Security Engineering & Operations, Humana© 2023 Zscaler, Inc. All rights reserved.

Solution Brief

7

Our unique approach provides three key benefits to Azure users:• Zero attack surface and data loss prevention: Take traffic off the corporate network by using a direct-tocloud architecture and make applications in Azure environments invisible to cyberthreats, reducing therisk of data loss.
• Simplified cloud connectivity: Our zero trust architecture helps you avoid performance bottlenecks byconnecting workloads to other applications directly, eliminating IP overlap issues and the need for route
distributions.
• Superior application performance at scale: Zscaler is built on a truly distributed architecture where every
communication that reaches our service edge is instantly processed for identity and context. Our peering
relationship with the Microsoft Network ensures the shortest path between applications no matter
where they are hosted, reducing latency and improving application performance.

Workload-to-Internet
ZIA for Workloads
Prevent compromise
Inline cyber threat protection

Internet

Zero Trust
Exchange

Public cloud

Workload-to-workload

Public cloud

Workload microsegmentation

ZPA for Workloads

Prevent lateral movement
Identity-based segmentation
at the process level

Prevent lateral movement
Across DC and multi-cloud regions
Workload-to-workload segmentation

Data center

Figure 3: Zscaler provides zero trust security for Azure Workloads© 2023 Zscaler, Inc. All rights reserved.

Solution Brief

8

Zscaler and Microsoft Power the Modern Workforce
Zscaler and Microsoft integrations enable organizations to seamlessly secure their work from anywhereenvironments, protecting enterprise assets while powering an optimized, reliable digital experience forall users. The Zscaler Zero Trust platform enables fast, secure access to business applications, private
applications, internet, and SaaS, protecting business assets and data without compromising speed orreliability. Our joint customers also benefit from:• The Zscaler Zero Trust Exchange is the world’s largest inline security cloud with over 150 points ofpresence (PoPs) around the world, peering with Microsoft globally for fast performance• Fast, direct connectivity between remote users and their SaaS and private applications, which eliminates
the cost and complexity of legacy VPNs and firewalls, minimizes the attack surface, and prevents threats
from moving laterally across the network• A direct-to-Azure architecture that secures workload communications, simplifies connectivity, andimproves performance• Consistent zero trust security and efficient routing, which reduces latency and accelerates workload
migration to Azure• Optimized access to Microsoft 365 and Azure workloads keeps users happy and productive, while
helping organizations attract and retain the next generation of employees• Increased business agility for a competitive edge
Learn more about Zscaler zero trust security solutions and visit us at the Azure Marketplace today.

About Microsoft
Microsoft (Nasdaq “MSFT” @microsoft) enables digital transformation for the era of an intelligent cloud
and an intelligent edge. Its mission is to empower every person and every organization on the planet toachieve more.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient,resilient, and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks
and data loss by securely connecting users, devices, and applications in any location. Distributed acrossmore than 150 data centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloudsecurity platform. Learn more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2023 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,
ZIA™, Zscaler Private Access™, ZPA™, Zscaler Digital
Experience, and ZDX™, are either (i) registeredtrademarks or service marks or (ii) trademarks orservice marks of Zscaler, Inc. in the United States
and/or other countries. Any other trademarks are theproperties of their respective owners.

zscaler.com