# zpa-application\_segment-ba-onboard

> Claude/Codex skill by [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars · Updated 2026-10-12

End-to-end onboarding of a new Browser Access (BA) application in Zscaler Private Access. Walks through the full dependency chain — App connector group, server group, segment group, BA TLS certificate, BA application segment with apps\_config, and access policy rule — for web apps that should be reachable through the browser without Zscaler Client Connector. Use only when the admin explicitly asks for Browser Access. DO NOT USE WHEN: the admin wants a regular client-routed application segment (use zpa-application\_segment-onboard instead).

Tags: ai, gemini-cli-extension, hacktoberfest, mcp, mcp-server, pypi, zcc, zdx, zero-trust, zia, zpa, zscaler

## Install

```sh
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zpa/application_segment-ba-onboard ~/.claude/skills/zpa-application_segment-ba-onboard
```

## From README

ZPA: Onboard Browser Access Application Keywords browser access, ba application, clientless access, agentless zpa, web app publish, browser-only application, onboard browser access, no client connector, agentless access, ba app segment Overview Onboard a new Browser Access (BA) application in Zscaler Private Access. BA segments publish web applications to authorized users through the browser, without requiring Zscaler Client Connector. This skill walks through the full dependency chain — connector group → server group → segment group → BA TLS certificate → BA application segment with appsconfig → access policy rule. Use this skill when: The admin explicitly mentions Browser Access, agentless access, clientless ZPA, or publishing a web app to users who do not have ZCC installed. DO NOT use this skill when: The admin wants a regular client-routed application segment (any TCP/UDP app reachable via ZCC) — use zpa-applicationsegment-onboard instead.

## Links

- HTML page: https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zpa/application_segment-ba-onboard/
- GitHub: https://github.com/zscaler/zscaler-mcp-server
- Author: [@zscaler](https://omgskills.com/library/zscaler/index.md)

## More from this repo

- [cross-product-troubleshoot-user-connectivity](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/cross-product/troubleshoot-user-connectivity/index.md) — Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [easm-review-attack-surface](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/easm/review-attack-surface/index.md) — Used to review the organization's external attack surface using Zscaler EASM.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [zcc-generate-logout-otp](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zcc/generate-logout-otp/index.md) — Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars