# zpa-create-access-policy-rule

> Claude/Codex skill by [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars · Updated 2026-10-12

Create ZPA access policy rules with v2 conditions. Supports all condition object types: APP, APP\_GROUP, SAML, SCIM, SCIM\_GROUP, PLATFORM, COUNTRY\_CODE, POSTURE, TRUSTED\_NETWORK, RISK\_FACTOR\_TYPE, CLIENT\_TYPE, MACHINE\_GRP, LOCATION, and CHROME\_ENTERPRISE. Walks through: (1) gathering requirements, (2) looking up identity attributes (SAML/SCIM), (3) building the conditions payload, (4) creating the rule. Includes ready-to-use examples for common scenarios: SCIM group access, SAML attribute matching, platform restrictions, country-based access, posture checks, and combined conditions.

Tags: ai, gemini-cli-extension, hacktoberfest, mcp, mcp-server, pypi, zcc, zdx, zero-trust, zia, zpa, zscaler

## Install

```sh
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zpa/create-access-policy-rule ~/.claude/skills/zpa-create-access-policy-rule
```

## From README

ZPA: Create Access Policy Rule Keywords access policy, access rule, allow rule, deny rule, zpa policy, scim group policy, saml policy, platform restriction, country restriction, posture check, require approval, zero trust policy, conditional access Overview Create ZPA access policy rules that control who can access private applications. Access policies use the v2 condition format and support a rich set of condition types: identity-based (SAML/SCIM), device-based (platform, posture, Chrome Enterprise), network-based (trusted networks, country codes), and risk-based (ZIA risk factors). Use this skill when: An administrator asks to create an access policy rule, grant or deny application access based on user identity, device posture, location, or any combination of conditions. --- Condition Object Type Reference Each condition block must contain a single object type. Multiple condition blocks are ANDed together. Within a condition block, multiple operands or entryvalues are ORed.

## Links

- HTML page: https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zpa/create-access-policy-rule/
- GitHub: https://github.com/zscaler/zscaler-mcp-server
- Author: [@zscaler](https://omgskills.com/library/zscaler/index.md)

## More from this repo

- [cross-product-troubleshoot-user-connectivity](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/cross-product/troubleshoot-user-connectivity/index.md) — Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [easm-review-attack-surface](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/easm/review-attack-surface/index.md) — Used to review the organization's external attack surface using Zscaler EASM.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars
- [zcc-generate-logout-otp](https://omgskills.com/library/zscaler/zscaler-mcp-server/skills/zcc/generate-logout-otp/index.md) — Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.
   - [@zscaler](https://omgskills.com/library/zscaler/index.md) · 51 stars