Zscaler Client Connector (ZCC)
Connect Zscaler Client Connector to RAD Security and query every enrolled device with its owner, OS, agent version, policy and registration state.
RAD Security connects directly to the Client Connector Portal API with an API key and imports every enrolled device into the zscaler_zcc_devices data type: who owns it, what it runs, which Client Connector version and app policy it has, and whether it is still registered.
Read-only integration. RAD only lists devices. It never removes devices, changes policy or reads device passwords and one-time passwords.
Early access. This integration is enabled on request. Ask your RAD Security contact to turn it on for your workspace.
Prerequisites
- A Client Connector Portal on the classic login. Tenants on ZIdentity / OneAPI are not yet supported.
- Permission to create API keys in the Client Connector Portal
- A RAD Security workspace with integration permissions
What RAD stores
| Object | RAD data type | One row per | Refreshed |
|---|---|---|---|
| Enrolled devices | zscaler_zcc_devices | device (UDID) | every 4 hours |
Each row carries the device's UDID, machine_hostname as ZCC reports it and a normalized hostname that joins Lansweeper and the other Zscaler integrations, owner and user, company, OS type (Windows, macOS, iOS, Android, Linux) and version, manufacturer, MAC address, Client Connector agent, tunnel and UPM versions, app policy, registration state, and the registration, deregistration, last-seen, config-download and keep-alive times.
Removed devices stay in the list with their registration state, so you can tell a device that was deliberately removed from one that is simply not enrolled.
Step 1: Create an API key in the Client Connector Portal
Open the Public API page
In the Client Connector Portal open Administration > Public API.
Create a key with a read-only role
Add an API key for RAD with a read-only role. RAD never changes Client Connector configuration.
Copy the client ID and secret
The portal shows the secret only once, when the key is created. Copy it with the client ID.
Step 2: Configure in RAD Security
Open Data Sources > Integrations > Secure Access, add Zscaler Client Connector and fill in the fields.
| Field | Value |
|---|---|
| Cloud | Your Zscaler cloud, as in your ZIA admin portal address: admin.zscalertwo.net is zscalertwo |
| API key | The key's client ID |
| Secret key | The key's secret |
RAD calls only api-mobile.<cloud>.net for the cloud you pick; the host is never built from free text.
Once the status shows Connected, the first pass reads every enrolled device.
Sync cadence and API budget
Client Connector allows roughly 100 API calls per hour per key. A pass is a login plus one call per 5,000 devices, every 4 hours, so it uses a handful of calls. Verifying the integration uses two.
If Client Connector reports the hourly budget as spent, RAD stops and makes no further calls for an hour instead of retrying every few minutes. Sharing the key with other automation can therefore delay RAD's sync; give RAD its own key.
Reading the data
Every pass rewrites every device it reads, stamped with the time the pass started. The default view shows the last 24 hours, which always contains the latest complete pass.
last_seen_time is the best signal of a device that stopped checking in. Combine registration_state and last_seen_time to find registered devices that have gone quiet.