Integrate Cloud App Security with Zscaler
Applies to: Microsoft Cloud App Security
Threat protection product names from Microsoft are changing. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.
If you work with both Cloud App Security and Zscaler, you can integrate the two products to enhance your security Cloud Discovery experience. Zscaler, as a standalone cloud proxy, monitors your organization's traffic enabling you to set policies for blocking transactions. Together, Cloud App Security and Zscaler provide the following capabilities:
- Seamless deployment of Cloud Discovery - Use Zscaler to proxy your traffic and send it to Cloud App Security. This eliminates the need for installation of log collectors on your network endpoints to enable Cloud Discovery.
- Zscaler's block capabilities are automatically applied on apps you set as unsanctioned in Cloud App Security.
- Enhance your Zscaler portal with Cloud App Security's risk assessment for 200 leading cloud apps, which can be viewed directly in the Zscaler portal.
- A valid license for Microsoft Cloud App Security, or a valid license for Azure Active Directory Premium P1
- A valid license for Zscaler Cloud 5.6
- An active Zscaler NSS subscription
In the Zscaler portal, do the steps to complete the Zscaler partner integration with Microsoft Cloud App Security.
In the Cloud App Security portal, do the following integration steps:
Click on the settings cog and select Cloud Discovery Settings.
Click on the Automatic log upload tab and then click Add data source.
In the Add data source page, enter the following settings:
- Name = NSS
- Source = Zscaler QRadar LEEF
- Receiver type = Syslog - UDP
Make sure the name of the data source is NSS. For more information about setting up NSS feeds, see Adding Cloud App Security NSS Feeds.
Click View sample of expected log file. Then click Download sample log to view a sample discovery log, and make sure it matches your logs.
Investigate cloud apps discovered on your network. For more information and investigation steps, see Working with Cloud Discovery.
Any app that you set as unsanctioned in Cloud App Security will be pinged by Zscaler every two hours, and then automatically blocked by Zscaler. For more information about unsanctioning apps, see Sanctioning/unsanctioning an app.
If you run into any problems, we're here to help. To get assistance or support for your product issue, please open a support ticket.