Solution Brief

Zscaler for Microsoft
Cloud App Security© 2022 Zscaler, Inc. All rights reserved.

Zscaler and Microsoft have joined forces
to enable the secure adoption of cloudapplications. The native integration ofZscaler’s Zero Trust Exchange and Microsoft
Cloud App Security provides the protection,visibility, and controls required to securely
embrace the cloud.

Solution Brief© 2022 Zscaler, Inc. All rights reserved.

2

Solution Overview
When applications resided in the data center,organizations built networks to connect theirusers to these applications and protected thenetwork with a moat of security appliances.
However, enterprise applications have rapidly
been moving to the cloud to improve IT agility,advance innovation, improve productivity, andreduce costs.

Zscaler Nanolog™ Streaming Service (NSS)
streams real-time log data into Microsoft Cloud
App Security, which uses the ingested logs to
perform application discovery and classification
into sanctioned, permitted, and unsanctionedapplications. Administrators can define policy inMicrosoft Cloud App Security for each of thosecategories, which are then enforced inline throughZscaler. This integration enables customer to:• Enforce access control policies for sanctioned

One of the productivity benefits of cloud

applications on managed/unmanaged devices

applications is that users can access them from(example: block the download of a Salesforce

anywhere. But if they use direct-to-cloud

report to an unmanaged device)connections, as recommended, IT is left blindto this traffic and your organization may be atincreased risk. On the other hand, if you force thetraffic through centralized security controls before
it can go out to its cloud destination, you undo
the productivity and cost savings benefits you
gained by moving your apps to the cloud.
In the cloud world, the notion of providing• Securely enable the use of permitted
applications with granular DLP policies(example: allow uploads to permitted GitHub
repositories, while blocking uploads to others)• Identify and control access to unsanctioned
applications (example: block upload to PDF
merging tool)

security at the corporate network level isincreasingly irrelevant.
Zscaler’s Zero Trust Exchange sits in the cloud,between users and their applications, andIntegration Benefits

provides full inline threat protection, data loss

• Gain control over cloud application access:prevention (DLP), and cloud access control.

Unsanctioned applications defined in Microsoft

Distributed in over 150+ data centers around

Cloud App Security are automatically synced tothe world, and peering with Microsoft in a large

Zscaler, where access is controlled inline for all

number of them, Zscaler brings security close tousers, on and off network.

the user for complete protection and a fast
user experience.
Zscaler and Microsoft have partnered to provide a• Enhance visibility into shadow IT: Applications
discovered by Zscaler undergo a comprehensive
risk assessment and investigation based on
Microsoft Cloud App Security risk scoring.

closed-loop Cloud Access Security Broker (CASB)
solution to discover and control cloud applications
and shadow IT across all users, regardless oflocation or connection. Joint customers also

• Analyze cloud application usage: Integrationof Zscaler and Microsoft Cloud App Security
management consoles allows administrators
to investigate application usage by pivoting

receive a comprehensive risk assessment of all

between consoles via UI links and easy-to-use

services and the ability to enforce policies toactions and drill-downs.

protect users and keep corporate data safe.

© 2022 Zscaler, Inc. All rights reserved.

Solution Brief3

Microsoft Cloud App Security is also used to identify applications for which access should be blocked for
all users due to the risk associated with their use in compliance with customer policy. The list of restricted
applications is then pulled into Zscaler via API integration and populates as “Microsoft Cloud App Security
Unsanctioned Apps” under URL categories. In Zscaler, a policy can then be defined to block access to all
Microsoft Cloud App Security Unsanctioned Apps, which is enforced inline. The closed-loop integration
streamlines a process that would normally require multiple manual, repetitive workflows to export proxylogs to the CASB and then import configurations and blacklists back into the secure web gateway (SWG)
for enforcement.

Cloud apps
and services

1. NSS log forwarding
2. Cloud app discovery
and classification;
Policy definition forcloud access

1Logs

Zero Trust
Exchange

4Policy
Risk scoring32

3. Policy pulled via API;
Cloud App risk scoring
4. Inline enforcement ofcloud access policy

RemoteBranch

Headquarters

The combined solution from Zscaler and Microsoft yields joint customers several benefits:• Better security: Full inline inspection of all traffic from all users, on or off network, improves risk posture.
Policy can be applied immediately to newly discovered applications.
• Efficiency: Native integration saves time and resources. After the initial setup, discovery andenforcement cycle, synchronization is automated without the need for human intervention.
• Simplicity: Automated integration requires no additional deployments or manual, repetitive workflows.
Unified visibility on the management console exposes app risk info in a single location, improving theadministrative experience

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloud security platform. Learn
more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134©2022 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,ZIA™, Zscaler Private Access™, and ZPA™ areeither (i) registered trademarks or service marksor (ii) trademarks or service marks of Zscaler,Inc. in the United States and/or other countries.
Any other trademarks are the properties of theirrespective owners.

zscaler.com