Protect Zscaler data

Commvault protects Zscaler configuration data by backing up selected Zscaler Internet Access (ZIA) and Zscaler Private Access (ZPA) configuration objects through the Zscaler OneAPI. Each backup captures configuration snapshots as JSON documents, enabling you to recover critical security policies, access controls, and network topology settings.

What's supported

Zscaler requirements

• Zscaler OneAPI OAuth 2.0 access with an active client ID and client secret

• Zscaler Internet Access (ZIA) REST API v1 or Zscaler Private Access (ZPA) Management Configuration API v1

• API roles with permission to list and modify all configuration categories selected for protection

• ZIA roles synchronized in Zidentity API Resources before assignment to the OneAPI client

Supported resources and data

Zscaler protection operates at the tenant level and backs up supported ZIA and ZPA configuration categories. The backup hierarchy displays only categories verified as backup-and-restore capable.

Zscaler Internet Access (ZIA) categories:

• Rule Labels
• DLP Dictionaries (custom dictionaries only; Zscaler-managed dictionaries are view-only)
• DLP Engines (custom engines only; predefined engines are Zscaler-managed)
• URL Filter Rules
• Firewall Rules
• SSL Inspection Rules
• Bandwidth Control Rules
• Locations
• Cloud App Control Rules
• Authentication Settings (tenant-wide settings, update-only)

Zscaler Private Access (ZPA) categories:

• Segment Groups
• Application Segments
• App Connector Groups
• Trusted Networks
• PRA Consoles
• PRA Portals
• Policies (Access, Timeout, Client Forwarding, Inspection, Isolation)

Backup and restore capabilities

Data flow and storage

The Commvault access node connects to the Zscaler OneAPI to retrieve configuration object snapshots through ZIA and ZPA REST APIs, then writes the configuration data as JSON documents to the configured backup storage destination. Each category is serialized with the category name, object array, and backup timestamp.

What isn't supported

• Incremental backups: Only Full backups are supported; configuration changes between backups are not tracked incrementally.

• ZIA managed objects: Zscaler-managed DLP dictionaries and predefined DLP engines are view-only and cannot be restored.

• ZIA administrative configuration: Admin Roles and Admin Users cannot be generally restored because Zscaler blocks edits to internal roles, Executive Insights roles, and the API client's own role.

• ZIA advanced rules: Forwarding Control Rules can fail with rank-based restrictions; DLP Web Rules have SDK representation limitations; PAC Files use non-portable version-action APIs.

• ZPA infrastructure dependencies: Server Groups require App Connector Group relationships that cannot always be safely recreated; Identity Providers, Posture Profiles, and Machine Groups are update-only or not portable with the current API implementation.

• ZCC and ZDX data: Zscaler Client Connector (ZCC) configuration and Zscaler Digital Experience (ZDX) monitoring data are not supported for restore.

• Delete/synchronization operations: Restore does not remove objects absent from the backup; it only creates or updates objects present in the backup.

Limitations

• ZIA activation is required for ZIA changes to take effect. Commvault automatically invokes ZIA activation after successful ZIA writes, but the restore job fails if activation fails.

• Object IDs are tenant-specific and not reusable across different Zscaler tenants. Out-of-place restore remaps supported references by name rather than by ID.

• Per-object Zscaler authorization, tenant hierarchy, and feature licensing can still reject an otherwise supported update, resulting in restore errors for those specific objects.

• Configuration can change while a backup is running because Zscaler provides live API reads rather than an atomic tenant-wide configuration snapshot.