zpa-application_segment-ba-onboard
End-to-end onboarding of a new Browser Access (BA) application in Zscaler Private Access. Walks through the full dependency chain — App connector group, server group, segment group, BA TLS certificate, BA application segment with apps_config, and access policy rule — for web apps that should be reachable through the browser without Zscaler Client Connector. Use only when the admin explicitly asks for Browser Access. DO NOT USE WHEN: the admin wants a regular client-routed application segment (use zpa-application_segment-onboard instead).
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zpa/application_segment-ba-onboard" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zpa/application_segment-ba-onboard ~/.claude/skills/zpa-application_segment-ba-onboardFrom README
ZPA: Onboard Browser Access Application Keywords browser access, ba application, clientless access, agentless zpa, web app publish, browser-only application, onboard browser access, no client connector, agentless access, ba app segment Overview Onboard a new Browser Access (BA) application in Zscaler Private Access. BA segments publish web applications to authorized users through the browser, without requiring Zscaler Client Connector. This skill walks through the full dependency chain — connector group → server group → segment group → BA TLS certificate → BA application segment with appsconfig → access policy rule. Use this skill when: The admin explicitly mentions Browser Access, agentless access, clientless ZPA, or publishing a web app to users who do not have ZCC installed. DO NOT use this skill when: The admin wants a regular client-routed application segment (any TCP/UDP app reachable via ZCC) — use zpa-applicationsegment-onboard instead.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.