Zscaler & Okta
Improve the user experience bysimplifying authentication, automating
provisioning, and enabling adaptive zerotrust access to applications.

©2024 Zscaler, Inc. All rights reserved.

Partner Brief

The Market Challenge
In hybrid work environments, protecting
employees wherever they work poses challenges

Integration highlights:

for organizations. More remote employees across• Enable seamless single sign-on (SSO)

different locations using multiple devices createsand multifactor authentication (MFA)

more points of vulnerability. Users get frustrated

for fast, secure access to applications

with the need for separate credentials for cloud

and an improved user experience withvs. on-premises applications, and by the latency

SAML and OIDC integrations.

caused by VPNs and firewalls.
For IT and security teams, managing multiple
point products to ensure appropriate access tocorporate resources is complex and expensive.

• Dynamically manage application accesspolicies and automate provisioning
via SCIM to simplify life cyclemanagement.

Remote work and cloud adoption have expanded• Contain threats and enable adaptive

the attack surface, complicating security. To makezero trust access, up to and including

things worse, the cost and impact of breaches

Universal Logout, by exchanging risk

have risen significantly. Burdened with a variety

signals in real time through the Sharedof disconnected tools, IT security teams face

Signals Framework (SSF), delivered byfragmented visibility and struggle to balance risk

the Zscaler Deception and Okta ITP

mitigation with the user experience.

integration.

The Solution
Let’s Start with, “What is Zero Trust?”
Zero trust is a framework to secure modern

organization’s employees, contractors, andorganizations based on least-privileged accesspartners to safely use any technology they need,and the principle that no user or application

powered by their identity. This covers every

should be inherently trusted. Connections arepart of the identity life cycle, from governanceauthorized based on validation of the user’s

to access to privileged controls. Okta’s identity-identity, risk-based context, and business policy.

centric approach to zero trust ensures the right

Zero Trust and Continuous Authentication withOkta + Zscaler
Okta and Zscaler deliver a cloud-based, zero trust

people have access to the right technologies at
the right time to empower remote workforces
with full confidence.

security solution that combines Okta’s robust

Zscaler is a pioneer in zero trust, enabling

identity management capabilities with the Zscaler

customers to accelerate their secure digital

Zero Trust Exchange™ platform.

transformation journey. The cloud-delivered Zero

The first step to implement zero trust is toconfirm the user is who they say they are. As
the leading identity provider, Okta enables an©2024 Zscaler, Inc. All rights reserved.

Trust Exchange platform serves as an intelligent
switchboard that securely connects users andapplications.

PARTNER BRIEF

02

Once a user is authenticated via Okta, the Zeroaway a user’s password. A critical timesaver in

Trust Exchange inspects all traffic and validates

modern work environments where the average

access rights based on the user’s identity andemployee switches job-critical applications

context using the principles of least-privileged

multiple times a day, the OAuth protocol

access. This ensures users can only accessseamlessly passes authorization from one

applications they’re authorized for, and makes

application to another, all while protecting theapplications invisible to unauthorized users

user’s username and password.

preventing them from being discoveredand exploited.

Finally, Zscaler Deception integrates with Okta
Identity Threat Protection (ITP) to contain threats

Together, Okta and Zscaler deliver a cloud-based

from compromised insiders or targeted external

zero trust solution that provides users fast andattacks. The integration supports adaptive

secure access to the internet, SaaS, and private

security measures and continuous authentication

applications—over any network, at any location,

to ensure zero trust security policies are enforced

and on any device. Risk-based access provides ain real time. Zscaler Deception uses decoy

seamless user experience and increased security

systems and data to send high-fidelity risk

when needed.

signals to Okta using SSF, which Okta can use to
make authentication-based decisions, up to andKey Integrations

including enforcing universal logout.

Okta and Zscaler integrate using industrystandard authentication protocols, including
Security Assertion Markup Language (SAML) andOpenID Connect (OIDC). SAML and OIDC enable
seamless authentication for capabilities like SSO
and MFA, which improve the user experience andenhance security.
Zscaler and Okta also support the System for
Cross-domain Identity Management (SCIM)
for automated provisioning and life cycle
management, ensuring the real-time, APIbased synchronization of user information forrole changes (i.e., adders/movers/leavers). SCIM
provisioning reduces the time and effort spent on
manually ensuring that only authorized users haveaccess to the appropriate resources.

Our seamlessintegrations withOkta help customers
provide continuous
authentication andzero trust access toapplications withoutcompromising onsecurity or userexperience.”

Additionally, Zscaler and Okta support Open—Punit Minocha, EVP, Business andAuthorization (OAuth), an open standard for

Corporate Development, Zscaler

authorization that enables applications to obtain
limited access to a user’s data without giving©2024 Zscaler, Inc. All rights reserved.

PARTNER BRIEF

03

Secure accessto internet/SaaS

SAML for SSO
and device context

okta
SCIM integration
for identity updates

Secure accessto private apps

Zero TrustExchange

Continuous authentication
driven adaptive zero trust
access enforcement

Browser isolation

Managed device

Unmanaged device

Key Use Cases
The Okta and Zscaler integrations support theProtection (ITP) and Zscaler Deception enables

following use cases:

comprehensive defense against identity-based

Verify user identity
Okta maintains credentials about the user ID toverify they are who they say they are. SAML andOIDC integrations enable strong authentication

threats. Risk signals from Zscaler are sent to Okta,
allowing real-time automated responses
to mitigate risk up to and including
Universal Logout.

to verify user credentials and provide zero trust

Zscaler Deception delivers high-fidelity, early

access to only the required resources, regardlessdetection of targeted attacks and insider threatsof where those users are located.

through the use of decoy systems and data. By

Dynamically manage access rights
SCIM integration allows organizations tosynchronize users and security groups
between Okta and Zscaler in near-real time tosharing these validated threat signals with Okta
ITP, organizations can trigger real-time accesspolicy changes and targeted mitigation actions
based on confirmed indicators of compromise.

automatically update, manage, and remove accessThis powerful integration enables policy-to company resources based on role changes

based actions and workflow-driven responses(adds, transfers, exits).

in Okta for identity-related risk events in real

Mitigate and contain identity risk
The integration between Okta Identity Threat©2024 Zscaler, Inc. All rights reserved.

time, empowering organizations to configure
countermeasures that can mitigate further risk.

PARTNER BRIEF04

Customer BenefitsConclusion

Reduce the attack surface: Ensure zero trust

Deliver better business results withaccess with risk-based authentication thatZscaler and Okta

securely connects users directly to authorized

Okta and Zscaler deliver a cloud-based zeroapps without accessing the network to prevent

trust solution that replaces traditional security

the lateral movement of threats.

architectures that leverage VPNs and firewalls.

Improve the user experience: Simplify
deployment and enable fast, direct, andsecure access to apps anywhere with seamlessintegrations for single sign-on (SSO), multifactor
authentication (MFA), and life cycle
management (LCM).

Connections to applications are authorized basedon the user’s identity, business policies, andcontext; including user location, device security
posture, application being accessed, and content
being exchanged. The net results are reduced
risk, an improved user experience, and simplified
management and deployment. Additionally,

Continuous Authentication and Universal

by integrating Okta ITP with Zscaler Deception

Logout: Maintain user identity verification

technology, organizations can confidently prevent

throughout the user’s session to detect anomalies

cyberattacks arising from identity-based risks.

or potential risks in real time. If suspicious activity
is detected, take proactive actions like session
termination using Universal Logout, triggering
adaptive policy-based actions on theZscaler platform.

Learn more at zscaler.com/okta
Download our Zscaler and Okta Deployment Guide

About Okta
Okta is the World’s Identity Company. As the leading independent Identity partner, we free everyone to safely
use any technology—anywhere, on any device or app. The most trusted brands trust Okta to enable secureaccess, authentication, and automation. With flexibility and neutrality at the core of our Okta Workforce Identity
and Customer Identity Clouds, business leaders and developers can focus on innovation and accelerate digitaltransformation, thanks to customizable solutions and more than 7,000 pre-built integrations. We’re building aworld where Identity belongs to you. Learn more at okta.com.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so that customers can be more agile, efficient, resilient,and secure. The Zscaler Zero Trust Exchange protects thousands of customers from cyberattacks and data loss
by securely connecting users, devices, and applications in any location. Distributed across more than 150 data
centers globally, the SASE-based Zero Trust Exchange is the world’s largest inline cloud security platform.
Learn more at zscaler.com or follow us on Twitter @zscaler.
+1 408.533.0288

Zscaler, Inc. (HQ) • 120 Holger Way • San Jose, CA 95134© 2024 Zscaler, Inc. All rights reserved. Zscaler™,
Zero Trust Exchange™, Zscaler Internet Access™,ZIA™, Zscaler Private Access™, ZPA™ andother trademarks listed at zscaler.com/legal/trademarks are either (i) registered trademarks orservice marks or (ii) trademarks or service marksof Zscaler, Inc. in the United States and/or othercountries. Any other trademarks are the propertiesof their respective owners.

zscaler.com