zpa-create-session-duration-rule
Create a ZPA Timeout Policy rule that enforces session duration — i.e. forces re-authentication after N minutes/hours/days, optionally with an idle-timeout. Use this skill when an admin asks for 'session duration', 'auto-revoke', 're-authentication interval', 'force re-auth after X hours', or 'session must expire after a workday' for ZPA. Scopes by SCIM group, SAML attribute, application segment, platform, and posture. ZPA Timeout Policy is a separate resource type from Access Policy; this skill creates timeout rules only and does not modify or pair with access rules.
Install
With your agent
Install OMGSkills skill "zscaler/zscaler-mcp-server:skills/zpa/create-session-duration-rule" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/zscaler/zscaler-mcp-server /tmp/zscaler-mcp-server && ln -s /tmp/zscaler-mcp-server/skills/zpa/create-session-duration-rule ~/.claude/skills/zpa-create-session-duration-ruleFrom README
ZPA: Create Session-Duration Rule (Timeout Policy) Keywords session duration, session timeout, force re-authentication, re-auth interval, auto-revoke session, session expiry, idle timeout, refresh posture, refresh risk How to talk to the admin (read this before you respond) The admin is asking a business question — "force re-auth after N hours". Tool plumbing is internal optimization the admin does not care about. Plain language only. Translate tool output into the admin's terms ("session expires after 4 hours; idle sessions disconnect after 15 minutes"). Don't paste back JMESPath expressions, search keys, projections, validation errors, or SDK tuple shapes. Empty is authoritative — do not fan out retries. A zpalist call with search=" " is a server-side substring match on the resource's name field. An empty result means the resource does not exist by that name. Stop.
More from this repo
cross-product-troubleshoot-user-connectivity
Cross-product troubleshooting of user connectivity issues spanning ZPA, ZIA, ZDX, and ZCC.
easm-review-attack-surface
Used to review the organization's external attack surface using Zscaler EASM.
zcc-generate-logout-otp
Used to generate a One-Time Logout Password (OTP) for a Zscaler Client Connector (ZCC) user.