What does Zscaler Browser Access mean?
Browser Access is a ZPA feature for browser-based access to configured private web applications. The user accesses an authorized application without receiving general network access in return.
The problem: A small application requirement creates a large onboarding process
For a single project application, managed devices, VPN client, certificates, and broad network permissions are often provisioned. This takes time and increases the technical attack surface.
However, clientless does not mean unconditional. Modern web functions, file transfers, authentication, session duration and browser compatibility must be tested. Otherwise, there will be a special access that does not work reliably in everyday life.
An external auditor needs read access to an internal web application for two weeks. The use case is limited to this application, a defined identity, a permitted browser and a fixed term.
Browser Access is an application-based access path
Suitability depends more on the application than on the network.
Web Application
Check URL, ports, redirects, WebSockets, downloads, and dependent hosts.
Identity
Uniquely authenticate external users and assign them to a suitable group.
Policy
Target application, user, context, and session conditions.
Browser
Test supported browsers, cookies, certificates, and modern web features.
Lifecycle
Plan invitation, expiration, revocation and regular eligibility checks.
Support
Differentiate error patterns between browser, identity provider, ZPA and application.
What needs to be checked before making a decision?
- Is the application technically suitable for Browser Access?
- What functions such as upload, download or WebSockets are required?
- How are external identities created and removed?
- What are the device or browser requirements?
- How long can the session and eligibility last?
- What alternative access path is provided in case of incompatibility?
Definition: Browser Access is suitable for supported private web applications, not automatically for every native, complex, or non-protocol application.
How SourcingBlox Introduces Browser Access
We test a clearly defined partner or BYOD case end-to-end.
Compatibility Check
Check application, dependencies, browser functions and authentication.
Access Pilot
Test identity, policy, session conditions, and typical user actions.
External-User Lifecycle
Establish onboarding, support, review, and automatic or manual withdrawal.
Typical mistakes
- To confuse clientless with controlless.
- Test only the login page instead of the full application flow.
- Create external accounts without an owner and expiration date.
- Do not provide a fallback path for technically unsuitable applications.
Frequently Asked Questions
Is Browser Access suitable for BYOD?
It can be suitable for selected use cases. However, protection needs, browser health, data actions, and application compatibility must be evaluated.
Does the user need Zscaler Client Connector?
The browser access approach is aimed at browser-based access without a client connector. The specific configuration and supported function must be checked.
Can any internal website be deployed?
No. Authentication, redirects, browser capabilities, and dependent hosts can limit eligibility.
Pilot external web access in a small and controlled manner.
We check application, identity, policy, lifecycle and support capability.
Related Content
Sources and further information
Supported browser, portal, and application features must be tested against the current ZPA documentation and with the target application.