Intune App Packaging

Deploy Zscaler Client Connector via Intune | Guide

Published 17 March 2026 · 7 min read

Zscaler Client Connector is a zero trust network access agent that routes user traffic through the Zscaler cloud. Deployment via Intune requires the MSI installer from your Zscaler admin portal, pre-configured with your cloud name and tenant URL so the agent connects to your environment automatically without user interaction.

Contents
  1. Prerequisites
  2. Download from the Zscaler portal
  3. Wrap with the Content Prep Tool
  4. Add the app in Intune
  5. Install and uninstall commands
  6. Detection rule
  7. Known gotchas

Prerequisites

Download from the Zscaler portal

Log in to your Zscaler admin portal and work through to:

Client Connector → Client Connector Portal → Downloads

Download the Windows MSI. Make sure you download the version matching your Zscaler cloud - the download page shows which cloud you are on.

Wrap with the Content Prep Tool

IntuneWinAppUtil.exe -c "C:\AppSource\Zscaler" -s "ZscalerClientConnectorSetup.msi" -o "C:\IntunePackages"

Add the app in Intune

Intune Admin Centre → Apps → Windows → + Add → Windows app (Win32)
  1. Upload the .intunewin file
  2. Name: Zscaler Client Connector
  3. Publisher: Zscaler, Inc.

Install and uninstall commands

⚙️
Program settings
Replace values with your Zscaler cloud and tenant details
Install commandCLOUDNAME must match your Zscaler cloud exactly
msiexec /i "ZscalerClientConnectorSetup.msi" /quiet /norestart USERDOMAIN=yourdomain.com CLOUDNAME=zscaler.net CLOUDURL=yourcompany.zscaler.net/
Uninstall command
msiexec /x "ZscalerClientConnectorSetup.msi" /quiet /norestart
Install behaviour
System
Device restart behaviour
No specific action
⚠️
Match your cloud name exactly
Zscaler has multiple clouds: zscaler.net, zscalertwo.net, zscalerthree.net, zscloud.net, and others. Using the wrong CLOUDNAME will prevent the client from connecting. Check your admin portal URL to identify your cloud.

Detection rule

🔍
File detection rule
[]
Rule type
File
Path
C:\Program Files\Zscaler\ZSATunnel
File or folder name
ZSATunnel.exe
Detection method
File or folder exists
💡
Test your detection rule first
Before deploying to users, install the app manually on a test device and verify the detection rule matches. Check the file path or registry key exists before assigning to a group.

Known gotchas

Users prompted to log in after install

If you have SSO configured via Entra ID (Azure AD), users will be auto-authenticated when they open Zscaler Client Connector. If SSO is not configured, users will see a login prompt. Ensure your Zscaler IdP authentication is set up in the admin portal before deploying at scale.

Split tunnel configuration

By default, Zscaler routes all traffic through the cloud. If you want to exclude certain apps or IP ranges, configure your tunnel profile in the Zscaler admin portal before deploying - these settings are pushed to the client automatically once it registers.

Frequently Asked Questions

Q: How do I deploy Zscaler Client Connector silently via Intune?

Use: ZscalerClientConnectorSetup-.msi /quiet /norestart USERDOMAIN=yourdomain.com CLOUDNAME=zscaler.net CLOUDURL=your-tenant.zscaler.net/. Download the MSI from your Zscaler admin portal under Client Connector.

Q: Where do I download the Zscaler Client Connector MSI?

Log in to your Zscaler admin portal, go to Client Connector > Client Connector Portal > Downloads. Download the Windows MSI installer for your Zscaler cloud (zscaler.net, zscalertwo.net, etc.).

Q: How do I pre-configure the Zscaler cloud and domain in the installer?

Pass CLOUDNAME, CLOUDURL, and USERDOMAIN as MSI properties in the install command. These connect the client to your specific Zscaler cloud and enable SSO auto-login for your domain users.

Q: How do I detect Zscaler Client Connector in Intune?

Use a file detection rule: check for ZSATunnel.exe in C:\Program Files\Zscaler\ZSATunnel. Alternatively check the registry under HKLM\SOFTWARE\Zscaler.

More App Packaging Guides
→ Deploy Palo Alto GlobalProtect via Intune→ Deploy Cisco AnyConnect via Intune→ Deploy CrowdStrike Falcon via Intune
Installer typeMSI
Cloud pre-configVia CLOUDNAME and CLOUDURL MSI properties
Silent installYes - /quiet /norestart
SSOVia Entra ID IdP configured in admin portal
Reboot requiredNo
// need intune set up properly?
Fixed-price Intune setup for UK businesses

I set up Intune for UK small businesses at a fixed price - app deployment, compliance policies, Conditional Access, and full documentation handed over at the end.

View Packages
#intune #app-packaging #win32