Plan how Commvault protects your Zscaler data. In most environments, you can start with recommended defaults and adjust only if your environment requires it.
Start with your Zscaler environment
Each Zscaler configuration in Commvault protects a single Zscaler tenant. If you manage multiple Zscaler tenants for different business units, environments (production, test, or development), or geographic regions, create a separate configuration for each tenant to maintain isolation and apply distinct protection policies.
Align storage with your Zscaler region
Neither the access node nor the backup storage destination has a regional placement requirement for Zscaler protection. You can use any access node and storage configuration that meets your organizational requirements for data locality, compliance, and operational continuity.
Understand backup behavior
Zscaler backups support Full backup levels only. Full backups discover the selected ZIA and ZPA configuration categories and retrieve all objects in each category. Incremental backups are not supported.
Zscaler provides live API reads rather than an atomic tenant-wide configuration snapshot. Configuration can change while a backup is running. Failures reading a selected supported category are surfaced as backup failures rather than silently treated as successful backups.
Decide how to scope your data
Zscaler backups operate at the tenant level with category-level granularity. When you configure protection, you select which ZIA and ZPA configuration categories to protect. Commvault backs up all objects within the selected categories that meet the backup scope criteria.
You can refine the scope by:
-
Selecting specific ZIA or ZPA categories from the browse tree
-
Selecting the entire Zscaler tenant to back up all supported categories
Organize backups logically
Use subclients to organize the backups based on how your organization manages Zscaler configuration. Common approaches include grouping by environment (production, test, or development), security domain (ZIA vs ZPA), or compliance requirements — whichever helps you apply consistent policies and simplifies monitoring and reporting.
Plan for performance
Backup and restore performance depends on configuration size, number of objects per category, and Zscaler API rate limits. The workload does not impose a fixed request-per-second rate; Zscaler tenant and API limits apply. Schedule large tenants conservatively and investigate Zscaler 429 throttling responses if they occur.
To optimize performance, avoid unnecessary fragmentation of protection scopes, and schedule backups to avoid peak Zscaler usage periods.
Confirm permissions early
Make sure the required Zscaler permissions are in place before configuring protection. For details, see Configure permissions for Zscaler protection.
Understand key limitations
Zscaler backups have the following key limitations:
-
Only Full backups are supported; incremental backups are not available.
-
ZIA managed DLP dictionaries and predefined DLP engines are view-only and cannot be restored.
-
ZIA Admin Roles, Admin Users, Forwarding Control Rules, DLP Web Rules, and PAC Files cannot be generally restored due to API restrictions.
-
ZPA Server Groups, Identity Providers, Posture Profiles, and Machine Groups are excluded because their dependencies cannot always be safely recreated.
-
ZCC and ZDX data are not supported for restore.
For complete details, see Protect Zscaler data.