Implementing
Zero Trust for
a Modern Work
Experience
with Zscaler and Microsoft

Created by Zscaler in collaboration with Microsoft

The world has fundamentally changed in just the last few
years. Today, employees and customers demand accessanytime, anywhere, and from any device. Chief information
officers (CIOs), chief information security officer (CISOs), andother Information Technology (IT) leaders must defend theirorganizations as attack surfaces expand and unknown threatsproliferate while, at the same time, ensuring a user experiencethat is fast, reliable, and seamless.
For competitive businesses, cloud transformation provides
potential for both limitless and revolutionary growth. As its
multifaceted benefits come into clearer focus, enterprisecompanies with forward-thinking leaders are aggressively
accelerating their use of more than 150 Software as a Service(SaaS) applications–like the Microsoft 365 suite–plus actively
expanding private applications into the public cloud.

68% of cybersecurity
professionals say their focus
on remote work accelerated thepriority of Zero Trust projects1

The rewards are truly significant. Human Resources canfurther recruit and retain the best talent in the industry.
Operations can dramatically improve the end user experience
for their employees and customers alike. As a bonus, theincreased business agility provided by such a transformation
allows companies to pivot more easily and remain productive
even when unexpected events like national disasters or
pandemics strike. But to securely and sustainably get here, theIT department must also transform their security architecture.

1. Cybersecurity Insiders, 2022 VPN Risk Report
Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

02

While the race is on to stay ahead of both hackers andcompetitors, IT leaders need to look backward to ensurethat legacy network and security technologies as well as
their associated critical business data are protected as well.
A survey of cybersecurity professionals reveals that 68%
say their focus on remote work accelerated the priority
of Zero Trust projects. And 78% of organizations areconcerned about ransomware attacks, but there remains
a lack of visibility into user activity and devices.1 Withlatency, limited global footprints, blind spots, and backhaul
traffic, it is difficult to find and fix performance issues.

78% of organizations areconcerned about ransomware attacks,
but there remains a lack of visibility
into user activity and devices1

The baseline requirement for employees, partners, andcustomers to collaborate and thrive anytime, fromanywhere, on any device–while still protecting users,
business data, and applications–is Zero Trust. Whennatively built on top of a highly distributed, global
cloud architecture, it reduces access hassles and keeps
employees productive and safe. Zscaler and Microsoft
solutions are tightly integrated, providing our mutual
customers with industry leading cloud-native Zero
Trust security, while increasing user productivity anddelivering an exceptional user experience.

1. Cybersecurity Insiders, 2022 VPN Risk Report
Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

03

Zscaler and Microsoft
keep companies nimble,
productive, and secure.
The Zscaler Zero Trust Exchange
connects Microsoft customers directly
to cloud resources
A Day in the Life of the Zscaler Zero Trust Exchange
Figure 1: Zscaler Zero Trust Exchange daily activity

300B+

7B+

requests per day

threats blocked
per day

250K+

Modern business demands an end-to-end, comprehensive
security framework. The Zscaler Zero Trust Exchange is
the industry leading2 inline security cloud with over 150
points of presence (PoPs) around the world, peering with
Microsoft globally. It acts as an intelligent switchboard to
broker connections between users, devices, and applications
wherever they reside. This brings security closer to theuser for fast access and a positive digital experience
without putting them on the corporate network. It reduces
the security risks, cost, and complexity associated withperimeter-based security solutions that extend the network,
expand the attack surface, increase the risk of lateral threat
movement, and fail to prevent data loss.
The integration of these two complementary services
solves both the bottom-up and top-down pressures CIOs,
CISOs, and other IT professionals are feeling. Employees
want to stay productive with instantaneous and seamlessconnections to SaaS applications like Microsoft 365, private
applications, the rest of the internet, and internally managed
applications. At the same time, executives and company
boards are demanding the highest levels of security, apositive end user experience, and deeper insights into aborderless service and access topology.

unique security
updates per day

2. Gartner: Magic Quadrant for Security Service Edge (SSE), April 10, 2023

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

04

By replacing legacy hub and spoke networks and security
products (e.g. virtual private networks (VPNs) andfirewalls) with direct user-to-application and applicationto-application connections, Zscaler keeps Microsoft
users’ enterprise resources off the network and invisible
to threat actors.
Three core services help Microsoft customers safely
empower their workforces:
Zscaler Private Access (ZPA) makes clunky VPNs
obsolete by connecting users directly to private
applications, bypassing networks altogether to keep
precious enterprise resources invisible to threats andminimize the attack surface.
Zscaler Internet Access (ZIA) connects end users
directly to the internet and to their SaaS applications
like Microsoft 365, reducing the cost and complexity of
traditional network and security products.
Zscaler Digital Experience (ZDX) is a multi-tenant
cloud-based monitoring platform that probes,
benchmarks, and optimizes digital experiences for every
user across the organization.

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

05

With this trio of offerings, Microsoft users can safely andseamlessly access the full suite of Microsoft productivity
apps like Microsoft 365, along with everything else Microsoft
Azure and the internet have to offer.
Microsoft and Zscaler work together to optimize user
experiences, centralize enterprise visibility, and keep
organizations’ applications and assets safe with a Zero Trust
security architecture that scales. Direct connections between
your end users and their SaaS and private applications meansno frustrating VPN headaches, no extended attack surface,and no opportunity for lateral threat movement.

“We want to get rid of VPNs. ZPAwith Azure AD will make it possible
for employees to access all internal
applications from anywhere.”
Jason Truong
VP, Network & Security Engineering & Operations
HumanaImplementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

06

Figure 2: Zscaler and Microsoft provide Zero Trust security to SaaS, internet, and private applications.

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

07

A Zero Trust frameworkthat seamlessly protects
business data.
Secure and scale with a comprehensive,cloud-native security solution

The anytime, anywhere, any device modern workplace has
been a boon for employees everywhere. With remote access,they can work from home, the office, or while on the go. For
CISOs and CIOs, however, this has dramatically increased
the attack surface area they must now protect from security
breaches, data leaks, and lateral threat movement. Every day,new unvetted endpoints are added
to networks.
A Zero Trust security posture, where each access request isevaluated, is critical. Together, Microsoft and the Zscaler Zero
Trust Exchange provide secure, direct communications between
your workforce and the applications and assets they need.
They provide reliable protection from external threats suchas phishing and ransomware, as well as more subtle internal
threats like common vulnerabilities and exposures (CVEs).
When an employee attempts to sign-in to a service runningon Microsoft Azure, or tries to add a file to a company folder,
the Zscaler Zero Trust Exchange will first verify the user andtheir device. It then investigates any content, evaluates othercontextual risk factors like location and behavior, determines
the final destination, and then allows or denies access according
to business policies. All of this is done behind the scenes,
without negatively impacting the user experience.
With increased security, companies can provide additional
flexibility to their employees. A Zero Trust platform, poweredby industry leading solutions from Zscaler and Microsoft,
results in more productive employees who can directly accessany content their jobs demand, and go anywhere the internet
reaches, securely.
Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

08

Zero Trust architecture

Microsoft Information Protection
Zscaler Cloud DLP

Microsoft Azure AD
Zscaler Internet / Private Access
Identities

Data

Microsoft Conditional AccessPolicy Optimization
Microsoft Defender for Endpoint

Microsoft Defender for Cloud Apps

Zscaler Internet / Private Access

Zscaler Internet AccessZero Trust Policy

Network

Apps

Microsoft Endpoint Manager
Zscaler Client Connector
Endpoints

Microsoft Defender for CloudThreat Protection

Zscaler for Workloads
Infrastructure

Microsoft Sentinel
Zscaler Internet / Private Access

Monitoring and analytics

Figure 3: Zscaler and Microsoft integrations provide Zero Trust Security

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

09

Integrated solutions
secure and power themodern workforce.
Your workforce needs to accessresources anytime, anywhere, andfrom any device
The COVID-19 pandemic is now mostly in the rearview
mirror, but the structural shifts it brought to the global
workforce are here to stay. The work-from-home movement
has accelerated the adoption of SaaS applications, and hybrid
footprints of on-premises data centers and private clouds
with a SaaS-like approach.
Security solutions from Zscaler and Microsoft enable ourcustomers in their Zero Trust journey. Our integrations
benefit our mutual customers with tangible security
enhancements and flexibility to meet their specific businessneeds. These integrations reduce business risk, increase
productivity, and decrease costs as organizations embark on
their digital transformation.

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

10

A few key integration examples include:

01

02

03

04

Zscaler integration with
Microsoft Azure Active
Directory delivers Zero
Trust network access(ZTNA) protection across
any environment. It enables
organizations to confidently
authenticate each user before
authorizing connections to
specific enterprise resources
across modern and classic
productivity applications–using legacy protocols
as needed. Seamless andfast access to applications
makes your employees moreproductive as they workfrom anywhere, using any
device–all while providing
the Zero Trust security yourorganization needs.

Paired with the Zscaler Cloud
Data Loss Protection (DLP)
service, Microsoft Information
Protection lets you set
automated labels that canbe used to block highly
sensitive files. This prevents
data exfiltration and ensurescompliance across all youremployees, independent of
the device. Meanwhile, youremployees can continue
to share key data and stayproductive while working fromanywhere.

If a user attempts to access a
suspicious file online, it is sent
to the ZIA Cloud Sandbox.
There, Zero-Day Threats arehandled safely by detonating
suspicious files. It can thencommunicate with solutions
like Microsoft Defender for
Endpoint to generate alerts,
trigger an investigation, pause
ongoing process execution,
and/or quarantine suspicious
files on any endpoint device.
An Indicator of Compromise
is also generated to prevent
future executions.

 he Zscaler Zero TrustT
Exchange, in tandem with
Microsoft Defender for
Cloud enables customers tosecurely implement hybrid andmulti-cloud environments.
As a result, applications
and workloads can securely
communicate witheach other across clouds andon-premises, and with otherinternet services.

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

11

05

06

07

08

The integration of Microsoft
Defender for Cloud Apps
with ZIA enables real-timestreaming of log data into
Defender, which uses thelogs to discover applications
and classify them as
sanctioned, permitted, or
unsanctioned. Administrators
can then define security
policies in Defender, which are
enforced by ZIA globally.

The integration of ZIA with
Microsoft Sentinel allows
billions of threat logs andtransactions to be quickly
ingested. As a result, Sentinelhas more data points,
which enables better threat
intelligence, visibility, anddetection globally.

ZPA enables organizations tomigrate on-prem applications
to Microsoft Azure more
quickly. By providing Zero
Trust security before, during,
and after migration, Zscaler
enables organizations to avoid
the time, cost, and complexitythat comes with legacy VPN
and firewall security products.

 scaler also works in tandem
Zwith Microsoft Intune toprovision and configure Zscaler
Client Connector, which can befurther extended via Windows
Autopilot. Device posturechecks by Microsoft Intune or
Defender provide security toensure that critical applications
are only accessed by authorizedusers.

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

12

A user experience so goodit’s a competitive advantage.
Security shouldn’t impede the best user
experience possible

Employees across the enterprise appreciate the fast,
reliable access to SaaS and private applications, cloud datastores, the internet, and other enterprise assets available
when Zscaler and Microsoft replace frustrating, outdated
VPN and firewall connections.
For CIOs, CISOs, and their teams, ZDX is a game changer.
ZDX provides end-to-end visibility and troubleshooting of
end-user performance issues for any user or application,
regardless of location. ZDX also provides powerful inspection
and diagnostic tools to pinpoint performance issues acrosseach application, network, or device so companies cancontinually improve their employees’ experience.
The ZDX Score provides an aggregated user experience
performance metric tracked over time at the user,
application, location, department, and organizational
level. It incorporates a varied set of metrics from the end
user device, network path, and SaaS/cloud application.
It provides insight into the current state of the end user
experience to enable more informed decisions. Thisempowers IT administrators to proactively troubleshootand provide remediation as needed to deliver a positive
experience for users across the organization.

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

13

Zscaler is part of the Microsoft 365 Networking Partner
Program, ensuring that users accessing the world’s mostpopular productivity suite are provided with a quick, optimized
access experience. This includes minimal latency and faster filethroughput all while allowing you to let go of legacy hub andspoke architectures and the cost and complexity associatedwith VPNs, firewalls, and other point products.
The addition of bandwidth controls, Transmission Control
Protocol (TCP) window shaping, and direct peering further
improve performance.
To recruit and retain the best talent in a competitiveenvironment, companies must provide an exceptional experiencefor both their employees and their customers. This requires
moving away from clunky legacy solutions that introduce latency
and expand the attack surface. The deep integrations between
Zscaler and Microsoft provide organizations with reliable,
frictionless access and a competitive advantage as they seek toattract and retain the next generation of employees.

Good riddance, VPNs!
70% of new remote access deployments

70%

will utilize ZTNA rather than VPN services
by 20253

By 2025, 80% of organizations seeking to

80%

procure SSE-related security services willpurchase a consolidated SSE solution4

When CIOs and CISOs at the forefront are constructing an
end-to-end security architecture, they appreciate the seamlessintegration of the Zscaler Zero Trust security platform–aleader in the Gartner Magic Quadrant for Security Service
Edge (SSE)–with Microsoft’s leading position in areas suchas access management, analytics, security information andevent management (SIEM), extended detection and response(XDR), and Endpoint Protection. Zscaler and Microsoft provide
comprehensive security and a cloud-native, highly distributed
architecture that keeps employees connected and nimble.

3. Gartner Identifies Three Factors Influencing Growth in Security Spending, October 13, 2022
4. Gartner: Magic Quadrant for Security Service Edge (SSE), April 10, 2023
Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

14

Zscaler and Microsoft:proven and integrated
Zero Trust solutions
As companies seek new ways to accelerate their digitaltransformation, enable remote bring your own device(BYOD) work, and shift company assets, infrastructure, andprocesses into the cloud, the need for comprehensive Zero
Trust protection keeps multiplying. The prospect of trying
to defend a cloud-first enterprise from external cyberattacks
and internal security compromises may seem daunting.
Zscaler and Microsoft integrations can help you simplify
your journey to a seamlessly secure work-from-anywhereenvironment, protecting enterprise assets while powering
an optimized, reliable digital experience for all users. The
Zscaler Zero Trust platform enables fast, direct, and secureaccess to public applications, private applications, theinternet, and SaaS; protecting users, applications, and data
without compromising speed or reliability.
With Zscaler and Microsoft technologies working
in tandem, organizations can confidently embrace
cloud-first services and hybrid workforces whileobtaining integrated, comprehensive Zero Trust
security that increases productivity and delivers an
exceptional user experience.

Learn how you can accelerate your digitaltransformation with Zero Trust security:

DiscoverZscaler
Solutions

DiscoverMicrosoft
Solutions

Visit Zscaler
at the Azure
Marketplace

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.

15

Implementing Zero Trust for a Modern Work Experience with Zscaler and Microsoft

Created by Zscaler in collaboration with Microsoft© 2023 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information andviews expressed in this document, including URL and other Internet Web site references, may change
without notice. You bear the risk of using it. Examples herein may be for illustration only and if so are
fictitious. No real association is intended or inferred.