# zpa-application\_segment-pra-onboard

> Claude/Codex skill by [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars · Updated 2026-10-12

End-to-end onboarding of a new Privileged Remote Access (PRA) application in Zscaler Private Access. Walks through the full dependency chain — App connector group, server group, segment group, PRA credential, PRA portal, PRA application segment with apps\_config (RDP/SSH targets), and access policy rule — for RDP and SSH targets brokered through the PRA portal without requiring a native RDP/SSH client or Zscaler Client Connector. Use only when the admin explicitly asks for Privileged Remote Access (PRA), RDP, SSH, jump-host, or bastion access. DO NOT USE WHEN: the admin wants a regular client-routed application segment (use zpa-application\_segment-onboard) or a clientless web app (use zpa-application\_segment-ba-onboard).

Tags: ai, gemini-cli-extension, hacktoberfest, mcp, mcp-server, pypi, zcc, zdx, zero-trust, zia, zpa, zscaler

## Install

```sh
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zpa/application_segment-pra-onboard ~/.claude/skills/zpa-application_segment-pra-onboard
```

## From README

ZPA: Onboard Privileged Remote Access (PRA) Application Keywords privileged remote access, pra, rdp access, ssh access, jump host, bastion host, jumpbox, pra portal, pra credential, agentless rdp, agentless ssh, browser rdp, browser ssh, secure remote access Overview Onboard a new Privileged Remote Access (PRA) application in Zscaler Private Access. PRA segments publish RDP and SSH targets to authorized users through Zscaler's PRA portal — the end user connects through their browser without a native RDP/SSH client and without ZCC. The connection is brokered by the PRA portal and authenticated using PRA credentials managed as separate ZPA resources. This skill walks through the full dependency chain: connector group → server group → segment group → PRA credential → PRA portal → PRA application segment with appsconfig → access policy rule.

## Links

- HTML page: https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zpa/application_segment-pra-onboard/
- GitHub: https://github.com/zscaler/zscaler-mcp-server
- Author: [@zscaler](https://omgskills.com/library/zscaler/index.md)

## More from this repo

- [cross-product-troubleshoot-user-connectivity](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/cross-product/troubleshoot-user-connectivity/index.md) — Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [easm-review-attack-surface](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/easm/review-attack-surface/index.md) — Used to review the organization's external attack surface using Zscaler EASM.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [zcc-generate-logout-otp](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zcc/generate-logout-otp/index.md) — Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars